compliance controls are associated with this Policy definition 'Correlate audit records' (10874318-0bf7-a41f-8463-03e395482080)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
AU-6 |
FedRAMP_High_R4_AU-6 |
FedRAMP High AU-6 |
Audit And Accountability |
Audit Review, Analysis, And Reporting |
Shared |
n/a |
The organization:
a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and
b. Reports findings to [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP. Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority. Related controls: AC-2, AC-3, AC-6, AC-17, AT-3, AU-7, AU-16, CA-7, CM-5, CM-10, CM-11, IA-3, IA-5, IR-5, IR-6, MA-4, MP-4, PE-3, PE-6, PE-14, PE-16, RA-5, SC-7, SC-18, SC-19, SI-3, SI-4, SI-7.
References: None. |
link |
25 |
| FedRAMP_High_R4 |
AU-6(1) |
FedRAMP_High_R4_AU-6(1) |
FedRAMP High AU-6 (1) |
Audit And Accountability |
Process Integration |
Shared |
n/a |
The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
Supplemental Guidance: Organizational processes benefiting from integrated audit review, analysis, and reporting include, for example, incident response, continuous monitoring, contingency planning, and Inspector General audits. Related controls: AU-12, PM-7. |
link |
11 |
| FedRAMP_High_R4 |
AU-6(3) |
FedRAMP_High_R4_AU-6(3) |
FedRAMP High AU-6 (3) |
Audit And Accountability |
Correlate Audit Repositories |
Shared |
n/a |
The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
Supplemental Guidance: Organization-wide situational awareness includes awareness across all three tiers of risk management (i.e., organizational, mission/business process, and information system) and supports cross-organization awareness. Related controls: AU-12, IR-4. |
link |
2 |
| FedRAMP_High_R4 |
RA-5(8) |
FedRAMP_High_R4_RA-5(8) |
FedRAMP High RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
Supplemental Guidance: Related control: AU-6. |
link |
15 |
| FedRAMP_Moderate_R4 |
AU-6 |
FedRAMP_Moderate_R4_AU-6 |
FedRAMP Moderate AU-6 |
Audit And Accountability |
Audit Review, Analysis, And Reporting |
Shared |
n/a |
The organization:
a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and
b. Reports findings to [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP. Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority. Related controls: AC-2, AC-3, AC-6, AC-17, AT-3, AU-7, AU-16, CA-7, CM-5, CM-10, CM-11, IA-3, IA-5, IR-5, IR-6, MA-4, MP-4, PE-3, PE-6, PE-14, PE-16, RA-5, SC-7, SC-18, SC-19, SI-3, SI-4, SI-7.
References: None. |
link |
25 |
| FedRAMP_Moderate_R4 |
AU-6(1) |
FedRAMP_Moderate_R4_AU-6(1) |
FedRAMP Moderate AU-6 (1) |
Audit And Accountability |
Process Integration |
Shared |
n/a |
The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
Supplemental Guidance: Organizational processes benefiting from integrated audit review, analysis, and reporting include, for example, incident response, continuous monitoring, contingency planning, and Inspector General audits. Related controls: AU-12, PM-7. |
link |
11 |
| FedRAMP_Moderate_R4 |
AU-6(3) |
FedRAMP_Moderate_R4_AU-6(3) |
FedRAMP Moderate AU-6 (3) |
Audit And Accountability |
Correlate Audit Repositories |
Shared |
n/a |
The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
Supplemental Guidance: Organization-wide situational awareness includes awareness across all three tiers of risk management (i.e., organizational, mission/business process, and information system) and supports cross-organization awareness. Related controls: AU-12, IR-4. |
link |
2 |
| FedRAMP_Moderate_R4 |
RA-5(8) |
FedRAMP_Moderate_R4_RA-5(8) |
FedRAMP Moderate RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
Supplemental Guidance: Related control: AU-6. |
link |
15 |
| hipaa |
0202.09j1Organizational.3-09.j |
hipaa-0202.09j1Organizational.3-09.j |
0202.09j1Organizational.3-09.j |
02 Endpoint Protection |
0202.09j1Organizational.3-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
Audit logs of the scans are maintained. |
|
15 |
| hipaa |
0216.09j2Organizational.9-09.j |
hipaa-0216.09j2Organizational.9-09.j |
0216.09j2Organizational.9-09.j |
02 Endpoint Protection |
0216.09j2Organizational.9-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
For systems considered not commonly affected by malicious software, the organization performs periodic assessments to identify and evaluate evolving malware threats to confirm whether such systems continue to not require anti-virus software. |
|
13 |
| hipaa |
0217.09j2Organizational.10-09.j |
hipaa-0217.09j2Organizational.10-09.j |
0217.09j2Organizational.10-09.j |
02 Endpoint Protection |
0217.09j2Organizational.10-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
The organization configures malicious code and spam protection mechanisms to (i) perform periodic scans of the information system according to organization guidelines; (ii) perform real-time scans of files from external sources at endpoints and network entry/exit points as the files are downloaded, opened, or executed in accordance with organizational security policy; and, (iii) block malicious code, quarantine malicious code, or send an alert to the administrator in response to malicious code detection. |
|
25 |
| hipaa |
0714.10m2Organizational.7-10.m |
hipaa-0714.10m2Organizational.7-10.m |
0714.10m2Organizational.7-10.m |
07 Vulnerability Management |
0714.10m2Organizational.7-10.m 10.06 Technical Vulnerability Management |
Shared |
n/a |
The technical vulnerability management program is evaluated on a quarterly basis. |
|
20 |
| hipaa |
0790.10m3Organizational.22-10.m |
hipaa-0790.10m3Organizational.22-10.m |
0790.10m3Organizational.22-10.m |
07 Vulnerability Management |
0790.10m3Organizational.22-10.m 10.06 Technical Vulnerability Management |
Shared |
n/a |
The organization reviews historic audit logs to determine if high vulnerability scan findings identified in the information system have been previously exploited. |
|
17 |
| hipaa |
12101.09ab1Organizational.3-09.ab |
hipaa-12101.09ab1Organizational.3-09.ab |
12101.09ab1Organizational.3-09.ab |
12 Audit Logging & Monitoring |
12101.09ab1Organizational.3-09.ab 09.10 Monitoring |
Shared |
n/a |
The organization specifies how often audit logs are reviewed, how the reviews are documented, and the specific roles and responsibilities of the personnel conducting the reviews, including the professional certifications or other qualifications required. |
|
18 |
| hipaa |
12103.09ab1Organizational.5-09.ab |
hipaa-12103.09ab1Organizational.5-09.ab |
12103.09ab1Organizational.5-09.ab |
12 Audit Logging & Monitoring |
12103.09ab1Organizational.5-09.ab 09.10 Monitoring |
Shared |
n/a |
Information collected from multiple sources is aggregated for review. |
|
11 |
| hipaa |
1216.09ab3System.12-09.ab |
hipaa-1216.09ab3System.12-09.ab |
1216.09ab3System.12-09.ab |
12 Audit Logging & Monitoring |
1216.09ab3System.12-09.ab 09.10 Monitoring |
Shared |
n/a |
Automated systems are used to review monitoring activities of security systems (e.g., IPS/IDS) and system records on a daily basis, and identify and document anomalies. |
|
20 |
| hipaa |
1222.09ab3System.8-09.ab |
hipaa-1222.09ab3System.8-09.ab |
1222.09ab3System.8-09.ab |
12 Audit Logging & Monitoring |
1222.09ab3System.8-09.ab 09.10 Monitoring |
Shared |
n/a |
The organization analyzes and correlates audit records across different repositories using a security information and event management (SIEM) tool or log analytics tools for log aggregation and consolidation from multiple systems/machines/devices, and correlates this information with input from non-technical sources to gain and enhance organization-wide situational awareness. Using the SIEM tool, the organization devise profiles of common events from given systems/machines/devices so that it can tune detection to focus on unusual activity, avoid false positives, more rapidly identify anomalies, and prevent overwhelming analysts with insignificant alerts. |
|
10 |
| hipaa |
1270.09ad1System.12-09.ad |
hipaa-1270.09ad1System.12-09.ad |
1270.09ad1System.12-09.ad |
12 Audit Logging & Monitoring |
1270.09ad1System.12-09.ad 09.10 Monitoring |
Shared |
n/a |
The organization ensures proper logging is enabled in order to audit administrator activities; and reviews system administrator and operator logs on a regular basis. |
|
18 |
| hipaa |
1512.11a2Organizational.8-11.a |
hipaa-1512.11a2Organizational.8-11.a |
1512.11a2Organizational.8-11.a |
15 Incident Management |
1512.11a2Organizational.8-11.a 11.01 Reporting Information Security Incidents and Weaknesses |
Shared |
n/a |
Intrusion detection/information protection system (IDS/IPS) alerts are utilized for reporting information security events. |
|
17 |
| hipaa |
1519.11c2Organizational.2-11.c |
hipaa-1519.11c2Organizational.2-11.c |
1519.11c2Organizational.2-11.c |
15 Incident Management |
1519.11c2Organizational.2-11.c 11.02 Management of Information Security Incidents and Improvements |
Shared |
n/a |
For unauthorized disclosures of covered information, a log is maintained and annually submitted to the appropriate parties (e.g., a state, regional or national regulatory agency). |
|
14 |
| ISO27001-2013 |
A.12.4.1 |
ISO27001-2013_A.12.4.1 |
ISO 27001:2013 A.12.4.1 |
Operations Security |
Event Logging |
Shared |
n/a |
Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. |
link |
53 |
| ISO27001-2013 |
A.16.1.2 |
ISO27001-2013_A.16.1.2 |
ISO 27001:2013 A.16.1.2 |
Information Security Incident Management |
Reporting information security events |
Shared |
n/a |
Information security events shall be reported through appropriate management channels as quickly as possible. |
link |
14 |
| ISO27001-2013 |
A.16.1.4 |
ISO27001-2013_A.16.1.4 |
ISO 27001:2013 A.16.1.4 |
Information Security Incident Management |
Assessment of and decision on information security events |
Shared |
n/a |
Information security events shall be assessed and it shall be decided if they are to be classified as information security incidents. |
link |
23 |
| NIST_SP_800-171_R2_3 |
.3.1 |
NIST_SP_800-171_R2_3.3.1 |
NIST SP 800-171 R2 3.3.1 |
Audit and Accountability |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures. Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. [SP 800-92] provides guidance on security log management. |
link |
53 |
| NIST_SP_800-171_R2_3 |
.3.5 |
NIST_SP_800-171_R2_3.3.5 |
NIST SP 800-171 R2 3.3.5 |
Audit and Accountability |
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Correlating audit record review, analysis, and reporting processes helps to ensure that they do not operate independently, but rather collectively. Regarding the assessment of a given organizational system, the requirement is agnostic as to whether this correlation is applied at the system level or at the organization level across all systems. |
link |
13 |
| NIST_SP_800-53_R4 |
AU-6 |
NIST_SP_800-53_R4_AU-6 |
NIST SP 800-53 Rev. 4 AU-6 |
Audit And Accountability |
Audit Review, Analysis, And Reporting |
Shared |
n/a |
The organization:
a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and
b. Reports findings to [Assignment: organization-defined personnel or roles].
Supplemental Guidance: Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP. Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority. Related controls: AC-2, AC-3, AC-6, AC-17, AT-3, AU-7, AU-16, CA-7, CM-5, CM-10, CM-11, IA-3, IA-5, IR-5, IR-6, MA-4, MP-4, PE-3, PE-6, PE-14, PE-16, RA-5, SC-7, SC-18, SC-19, SI-3, SI-4, SI-7.
References: None. |
link |
25 |
| NIST_SP_800-53_R4 |
AU-6(1) |
NIST_SP_800-53_R4_AU-6(1) |
NIST SP 800-53 Rev. 4 AU-6 (1) |
Audit And Accountability |
Process Integration |
Shared |
n/a |
The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
Supplemental Guidance: Organizational processes benefiting from integrated audit review, analysis, and reporting include, for example, incident response, continuous monitoring, contingency planning, and Inspector General audits. Related controls: AU-12, PM-7. |
link |
11 |
| NIST_SP_800-53_R4 |
AU-6(3) |
NIST_SP_800-53_R4_AU-6(3) |
NIST SP 800-53 Rev. 4 AU-6 (3) |
Audit And Accountability |
Correlate Audit Repositories |
Shared |
n/a |
The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
Supplemental Guidance: Organization-wide situational awareness includes awareness across all three tiers of risk management (i.e., organizational, mission/business process, and information system) and supports cross-organization awareness. Related controls: AU-12, IR-4. |
link |
2 |
| NIST_SP_800-53_R4 |
RA-5(8) |
NIST_SP_800-53_R4_RA-5(8) |
NIST SP 800-53 Rev. 4 RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
Supplemental Guidance: Related control: AU-6. |
link |
15 |
| NIST_SP_800-53_R5 |
AU-6 |
NIST_SP_800-53_R5_AU-6 |
NIST SP 800-53 Rev. 5 AU-6 |
Audit and Accountability |
Audit Record Review, Analysis, and Reporting |
Shared |
n/a |
a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
b. Report findings to [Assignment: organization-defined personnel or roles]; and
c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. |
link |
25 |
| NIST_SP_800-53_R5 |
AU-6(1) |
NIST_SP_800-53_R5_AU-6(1) |
NIST SP 800-53 Rev. 5 AU-6 (1) |
Audit and Accountability |
Automated Process Integration |
Shared |
n/a |
Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms]. |
link |
11 |
| NIST_SP_800-53_R5 |
AU-6(3) |
NIST_SP_800-53_R5_AU-6(3) |
NIST SP 800-53 Rev. 5 AU-6 (3) |
Audit and Accountability |
Correlate Audit Record Repositories |
Shared |
n/a |
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness. |
link |
2 |
| NIST_SP_800-53_R5 |
RA-5(8) |
NIST_SP_800-53_R5_RA-5(8) |
NIST SP 800-53 Rev. 5 RA-5 (8) |
Risk Assessment |
Review Historic Audit Logs |
Shared |
n/a |
Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time period]. |
link |
15 |
| PCI_DSS_v4.0 |
10.4.1 |
PCI_DSS_v4.0_10.4.1 |
PCI DSS v4.0 10.4.1 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are reviewed to identify anomalies or suspicious activity |
Shared |
n/a |
The following audit logs are reviewed at least once daily:
• All security events.
• Logs of all system components that store, process, or transmit CHD and/or SAD.
• Logs of all critical system components.
• Logs of all servers and system components that perform security functions (for example, network security controls, intrusion-detection systems/intrusion-prevention systems (IDS/IPS), authentication servers). |
link |
11 |
| PCI_DSS_v4.0 |
10.4.1.1 |
PCI_DSS_v4.0_10.4.1.1 |
PCI DSS v4.0 10.4.1.1 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are reviewed to identify anomalies or suspicious activity |
Shared |
n/a |
Automated mechanisms are used to perform audit log reviews. |
link |
11 |
| PCI_DSS_v4.0 |
10.4.2 |
PCI_DSS_v4.0_10.4.2 |
PCI DSS v4.0 10.4.2 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are reviewed to identify anomalies or suspicious activity |
Shared |
n/a |
Logs of all other system components (those not specified in Requirement 10.4.1) are reviewed periodically. |
link |
11 |
| PCI_DSS_v4.0 |
10.4.2.1 |
PCI_DSS_v4.0_10.4.2.1 |
PCI DSS v4.0 10.4.2.1 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are reviewed to identify anomalies or suspicious activity |
Shared |
n/a |
The frequency of periodic log reviews for all other system components (not defined in Requirement 10.4.1) is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement12.3.1 |
link |
11 |
| PCI_DSS_v4.0 |
10.4.3 |
PCI_DSS_v4.0_10.4.3 |
PCI DSS v4.0 10.4.3 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit logs are reviewed to identify anomalies or suspicious activity |
Shared |
n/a |
Exceptions and anomalies identified during the review process are addressed. |
link |
11 |
| SWIFT_CSCF_v2022 |
6.1 |
SWIFT_CSCF_v2022_6.1 |
SWIFT CSCF v2022 6.1 |
6. Detect Anomalous Activity to Systems or Transaction Records |
Ensure that local SWIFT infrastructure is protected against malware and act upon results. |
Shared |
n/a |
Anti-malware software from a reputable vendor is installed, kept up-to-date on all systems, and results are considered for appropriate resolving actions. |
link |
31 |
| SWIFT_CSCF_v2022 |
6.4 |
SWIFT_CSCF_v2022_6.4 |
SWIFT CSCF v2022 6.4 |
6. Detect Anomalous Activity to Systems or Transaction Records |
Record security events and detect anomalous actions and operations within the local SWIFT environment. |
Shared |
n/a |
Capabilities to detect anomalous activity are implemented, and a process or tool is in place to keep and review logs. |
link |
52 |