AU-3: Content of Audit Records

audit records contain information that establishes what type of event occurred;

audit records contain information that establishes when the event occurred;

audit records contain information that establishes where the event occurred;

audit records contain information that establishes the source of the event;

audit records contain information that establishes the outcome of the event;

audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

Audit and accountability policy

system security plan

privacy plan

procedures addressing content of audit records

system design documentation

system configuration settings and associated documentation

list of organization-defined auditable events

system audit records

system incident reports

other relevant documents or records

Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Mechanisms implementing system auditing of auditable events