Sharing of Audit Information
LOW MODERATE HIGHRequirements NIST SOURCE
Provide cross-organizational audit information to [organizations] based on [cross-organizational sharing agreements].
Discussion (NIST Supplemental Guidance)
Due to the distributed nature of the audit information, cross-organization sharing of audit information may be essential for effective analysis of the auditing being performed. For example, the audit records of one organization may not provide sufficient information to determine the appropriate or inappropriate use of organizational information resources by individuals in other organizations. In some instances, only individuals’ home organizations have the appropriate knowledge to make such determinations, thus requiring the sharing of audit information among organizations.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for AU-16(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- organizations with which cross-organizational audit information is to be shared are defined;
- cross-organizational sharing agreements to be used when providing cross-organizational audit information to organizations are defined;
- cross-organizational audit information is provided to <AU-16(02)_ODP[01] organizations> based on <AU-16(02)_ODP[02] cross-organizational sharing agreements>.
Examine
[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing cross-organizational sharing of audit information; information sharing agreements; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with responsibilities for sharing cross-organizational audit information; organizational personnel with information security and privacy responsibilities].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for AU-16(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Audit and accountability policy
- system security plan
- privacy plan
Other Records
- procedures addressing cross-organizational sharing of audit information
- information sharing agreements
- other relevant documents or records