Joint task force transformation initiative

P1

LOW AU-12

MOD AU-12

HIGH AU-12 (1) (3)

AU-13 MONITORING FOR INFORMATION DISCLOSURE

Control: The organization monitors [Assignment: organization-defined open source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information.

Supplemental Guidance: Open source information includes, for example, social networking sites. Related controls: PE-3, SC-7.

Control Enhancements:

1. 
   monitoring for information disclosure | use of automated tools
   

The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.

Supplemental Guidance: Automated mechanisms can include, for example, automated scripts to monitor new posts on selected websites, and commercial services providing notifications and alerts to organizations.

2. 
   monitoring for information disclosure | review of monitored sites
   

The organization reviews the open source information sites being monitored [Assignment: organization-defined frequency].

References: None.

Priority and Baseline Allocation:

P0

LOW Not Selected

MOD Not Selected

HIGH Not Selected

AU-14 SESSION AUDIT

Control: The information system provides the capability for authorized users to select a user session to capture/record or view/hear.

Supplemental Guidance: Session audits include, for example, monitoring keystrokes, tracking websites visited, and recording information and/or file transfers. Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, or standards. Related controls: AC-3, AU-4, AU-5, AU-9, AU-11.

Control Enhancements:

1. 
   session audit | system start-up
   

The information system initiates session audits at system start-up.

2. 
   session audit | capture/record and log content
   

The information system provides the capability for authorized users to capture/record and log content related to a user session.

3. 
   session audit | remote viewing / listening
   

The information system provides the capability for authorized users to remotely view/hear all content related to an established user session in real time.

References: None.

Priority and Baseline Allocation:

P0

LOW Not Selected

MOD Not Selected

HIGH Not Selected

AU-15 ALTERNATE AUDIT CAPABILITY

Control: The organization provides an alternate audit capability in the event of a failure in primary audit capability that provides [Assignment: organization-defined alternate audit functionality].

Supplemental Guidance: Since an alternate audit capability may be a short-term protection employed until the failure in the primary auditing capability is corrected, organizations may determine that the alternate audit capability need only provide a subset of the primary audit functionality that is impacted by the failure. Related control: AU-5.

Control Enhancements: None.

References: None.

Priority and Baseline Allocation:

P0

LOW Not Selected

MOD Not Selected

HIGH Not Selected