The ALG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.

Without identifying the users who initiated the traffic, it would be difficult to identify those responsible for the denied communications. This requirement applies to those network elements that perform Data Leakage Prevention (DLP) (e.g., ALGs, proxies, or application level firewalls).