Audit and Accountability

Create and retain system audit logs and records to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Regularly review and analyze audit logs to identify security events, then report findings to management.

Alert system administrators and security personnel immediately when audit logging or analysis failures occur.

Correlate audit data from multiple sources to identify patterns and complex attack sequences that individual logs cannot detect.

Create tools and processes to filter audit logs and generate reports that focus on security-relevant events rather than routine system activity.

Synchronize all system clocks to a reliable, authoritative time source so audit logs are trustworthy and events can be correlated accurately.

Protect audit logs from unauthorized access, modification, and deletion to preserve their integrity as evidence.

Limit audit log management functions (configuration, deletion, archival) to authorized individuals to prevent tampering.