💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)

• Contextual name: 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)
• ID: /frameworks/fedramp-high-security-controls/au/06
• Located in: 💼 Audit and Accountability

Description

a. Review and analyze system audit records [FedRAMP Assignment: at least weekly] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;

b. Report findings to [Assignment: organization-defined personnel or roles]; and

c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

AU-6 Additional FedRAMP Requirements and Guidance:

Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. In multi-tenant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.

Similar

• Sections
  • /frameworks/nist-sp-800-53-r5/au/06
• Internal
  • ID: dec-c-9bf5fa59

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 NIST SP 800-53 Revision 5 → 💼 AU-6 Audit Record Review, Analysis, and Reporting	10	1	11

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)			24
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)	2		30

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 AU-6(1) Automated Process Integration (M)(H)			1
💼 AU-6(3) Correlate Audit Record Repositories (M)(H)			8
💼 AU-6(4) Central Review and Analysis (H)			8
💼 AU-6(5) Integrated Analysis of Audit Records (H)
💼 AU-6(6) Correlation with Physical Monitoring (H)
💼 AU-6(7) Permitted Actions (H)

Policies (24)

Policy	Logic Count	Flags
📝 AWS Account IAM Access Analyzer is not enabled for all regions 🟢	1	🟢 x6
📝 AWS CloudTrail S3 Bucket Access Logging is not enabled. 🟢	1	🟢 x6
📝 AWS IAM Policy allows full administrative privileges 🟢	1	🟢 x6
📝 AWS S3 Bucket Server Access Logging is not enabled 🟢	1	🟢 x6
📝 AWS VPC Flow Logs are not enabled 🟢	1	🟠 x1, 🟢 x5
📝 Azure Diagnostic Setting for Azure Key Vault is not enabled 🟢		🟢 x3
📝 Azure PostgreSQL Flexible Server log_checkpoints Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure PostgreSQL Flexible Server log_retention_days Parameter is less than 4 days 🟢	1	🟢 x6
📝 Azure PostgreSQL Single Server log_connections Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure PostgreSQL Single Server log_disconnections Parameter is not set to ON 🟢	1	🟢 x6
📝 Azure SQL Server Auditing Retention is less than 90 days 🟢	1	🟢 x6
📝 Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests 🟢	1	🟢 x6
📝 Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests 🟢	1	🟢 x6
📝 Azure Subscription Activity Log Alert for Create or Update Network Security Group does not exist 🟢	1	🟢 x6
📝 Azure Subscription Activity Log Alert for Create or Update Security Solution does not exist 🟢	1	🟢 x6
📝 Azure Subscription Activity Log Alert for Create Policy Assignment does not exist 🟢	1	🟢 x6
📝 Azure Subscription Activity Log Alert for Delete Network Security Group does not exist 🟢	1	🟢 x6
📝 Azure Subscription Activity Log Alert for Delete Policy Assignment does not exist 🟢	1	🟢 x6
📝 Azure Subscription Activity Log Alert for Delete Security Solution does not exist 🟢	1	🟢 x6
📝 Azure Subscription Integration With Microsoft Defender For Cloud Apps is not enabled 🟢	1	🟢 x6
📝 Azure Subscription Security Alert Notifications additional email address is not configured 🟢	1	🟢 x6
📝 Azure Subscription Security Alert Notifications to subscription owners are not configured 🟢	1	🟢 x6
📝 Google Cloud Audit Logging is not configured properly 🟢	1	🟢 x6
📝 Google GCE Network DNS Policy Logging is not enabled 🟢	1	🟢 x6

Internal Rules

Rule	Policies	Flags
✉️ dec-x-0c82d775	1
✉️ dec-x-8a1ecfd0	1
✉️ dec-x-9b79d91f	1
✉️ dec-x-9c041667	1
✉️ dec-x-20c9ef83	1
✉️ dec-x-24bba483	1
✉️ dec-x-52ca1960	1
✉️ dec-x-89d5ed7a	1
✉️ dec-x-157aa4b9	1
✉️ dec-x-351e376f	1
✉️ dec-x-611eaa35	1
✉️ dec-x-1518c16e	1
✉️ dec-x-79579ed7	1
✉️ dec-x-9002886f	1
✉️ dec-x-ab7fc52e	1
✉️ dec-x-b2ce0ca1	1
✉️ dec-x-c397d3ca	2
✉️ dec-x-db1b7a1b	1
✉️ dec-x-dc359e59	1
✉️ dec-x-e0014333	2