[Withdrawn: Incorporated into SI-7.]
[Withdrawn: Incorporated into AU-14.]
[Withdrawn: Moved to AU-5(5).]
[Withdrawn: Incorporated into AU-12.]
Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. Outcome of the event; and f. Identity of any individuals, subjects, or objects/entities associated with the event.
Generate audit records containing the following additional information: [Assignment: organization-defined additional information].
[Withdrawn: Incorporated into AU-12.]
Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].
Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].
Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.