NIST SP 800-53 AU-14 Session Audit | Security Control Explorer

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Session audits can include monitoring keystrokes, tracking websites visited, and recording information and/or file transfers. Session audit capability is implemented in addition to event logging and may involve implementation of specialized session capture technology. Organizations consider how session auditing can reveal information about individuals that may give rise to privacy risk as well as how to mitigate those risks. Because session auditing can impact system and network performance, organizations activate the capability under well-defined situations (e.g., the organization is suspicious of a specific individual). Organizations consult with legal counsel, civil liberties officials, and privacy officials to ensure that any legal, privacy, civil rights, or civil liberties issues, including the use of personally identifiable information, are appropriately addressed.

Enhancements NIST SOURCE

AU-14(1) System Start-up LOW MODERATE HIGH

Initiate session audits automatically at system start-up.

Discussion

The automatic initiation of session audits at startup helps to ensure that the information being captured on selected individuals is complete and not subject to compromise through tampering by malicious threat actors.

Open full page for AU-14(1) →

AU-14(2) Capture and Record Content WITHDRAWN

Withdrawn. Incorporated into AU-14.

AU-14(3) Remote Viewing and Listening LOW MODERATE HIGH

Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.

Discussion

None.

Open full page for AU-14(3) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for AU-14 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

users or roles who can audit the content of a user session are defined;
one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log};
circumstances under which the content of a user session can be audited are defined;
<AU-14_ODP[01] users or roles> are provided with the capability to <AU-14_ODP[02] SELECTED PARAMETER VALUES> the content of a user session under <AU-14_ODP[03] circumstances>;
the capability for <AU-14_ODP[01] users or roles> to <AU-14_ODP[02] SELECTED PARAMETER VALUES> the content of a user session under <AU-14_ODP[03] circumstances> is implemented;
session auditing activities are developed in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
session auditing activities are integrated in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
session auditing activities are used in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing user session auditing; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information security and privacy responsibilities; system/network administrators; system developers; legal counsel; personnel with civil liberties responsibilities].

Test

[SELECT FROM: Mechanisms implementing user session auditing capability].

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for AU-14. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

Audit and accountability policy
system security plan
privacy plan

Configuration

system design documentation
system configuration settings and associated documentation

Testing

Mechanisms implementing user session auditing capability

Other Records

procedures addressing user session auditing
system audit records
other relevant documents or records