NIST 800-53

Meeting NIST SP 800-53 Security Controls

With the help of Blumira’s SIEM security platform, your organization can easily meet and exceed NIST 800-53 compliance requirements, including Audit and Accountability controls.

This provides guidelines on how Blumira helps address the needs of NIST 800-53 rev4 01/2015:

AU-1 – AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

The organization:

  • Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
  • An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  • Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls;
  • Reviews and updates the current:
    • Audit and accountability policy [Assignment: organization-defined frequency];
    • Audit and accountability procedures [Assignment: organization-defined frequency]

AU-2 – AUDIT EVENTS

The organization:

  • Determines that the information system is capable of auditing the following events:
    • [Assignment: organization-defined auditable events];
  • Coordinates the security audit function with other organizational entities requiring audit related information to enhance mutual support and to help guide the selection of auditable events;
  • Provides a rationale for why the auditable events are deemed to be adequate to support after the-fact investigations of security incidents
  • Determines that the following events are to be audited within the information system:
    • [Assignment: organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].

AU-3 – CONTENT OF AUDIT RECORDS

The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event. 


AU-4 – AUDIT STORAGE CAPACITYThe organization allocates audit record storage capacity in accordance with [Assignment: organization-defined audit record storage requirements]. 


AU-5 – RESPONSE TO AUDIT PROCESSING FAILURES

The information system:

  • Alerts [Assignment: organization-defined personnel or roles] in the event of an audit processing failure;
  • Takes the following additional actions:
    • [Assignment: organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)].

 AU-6 – AUDIT REVIEW, ANALYSIS, AND REPORTING

The organization:

  • Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity];
  • Reports findings to [Assignment: organization-defined personnel or roles]

 AU-7 – AUDIT REDUCTION AND REPORT GENERATION

The information system provides an audit reduction and report generation capability that:

  • Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents;
  • Does not alter the original content or time ordering of audit records.

AU-8 – TIME STAMPS

The information system:

  • Uses internal system clocks to generate time stamps for audit records;
  • Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: organization-defined granularity of time measurement].

 AU-9 – PROTECTION OF AUDIT INFORMATION

The information system protects audit information and audit tools from unauthorized access, modification, and deletion. 


AU-10 – NON-REPUDIATION

The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed [Assignment: organization-defined actions to be covered by non-repudiation]. 

AU-11 – AUDIT RECORD RETENTION

The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements. 


AU-12 – AUDIT GENERATION

The information system:

  • Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];
  • Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system;
  • Generates audit records for the events defined in AU-2 d. with the content defined in AU-3

 AU-13 – MONITORING FOR INFORMATION DISCLOSURE

The organization monitors [Assignment: organization-defined open source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information.


AU-14 – SESSION AUDIT

The information system provides the capability for authorized users to select a user session to capture/record or view/hear. 


AU-15 – ALTERNATE AUDIT CAPABILITY

The organization provides an alternate audit capability in the event of a failure in primary audit capability that provides [Assignment: organization-defined alternate audit functionality].


AU-16 – CROSS-ORGANIZATIONAL AUDITING

The organization employs [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries.