Audit Log Storage Capacity
✓ LOW ✓ MODERATE ✓ HIGHRequirements NIST SOURCE
Allocate audit log storage capacity to accommodate [audit log retention requirements].
Discussion (NIST Supplemental Guidance)
Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.
Enhancements NIST SOURCE
AU-4(1) Transfer to Alternate Storage LOW MODERATE HIGH
Transfer audit logs [frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Discussion
Audit log transfer, also known as off-loading, is a common process in systems with limited audit log storage capacity and thus supports availability of the audit logs. The initial audit log storage is only used in a transitory fashion until the system can communicate with the secondary or alternate system allocated to audit log storage, at which point the audit logs are transferred. Transferring audit logs to alternate storage is similar to AU-9(2) in that audit logs are transferred to a different entity. However, the purpose of selecting AU-9(2) is to protect the confidentiality and integrity of audit records. Organizations can select either control enhancement to obtain the benefit of increased audit log storage capacity and preserving the confidentiality, integrity, and availability of audit records and logs.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for AU-4 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- audit log retention requirements are defined;
- audit log storage capacity is allocated to accommodate <AU-04_ODP audit log retention requirements>.
Examine
[SELECT FROM: Audit and accountability policy; procedures addressing audit storage capacity; system security plan; privacy plan; system design documentation; system configuration settings and associated documentation; audit record storage requirements; audit record storage capability for system components; system audit records; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].
Test
[SELECT FROM: Audit record storage capacity and related configuration settings].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for AU-4. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Audit and accountability policy
- system security plan
- privacy plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Logging
- audit record storage requirements
- audit record storage capability for system components
Testing
- Audit record storage capacity and related configuration settings
Other Records
- procedures addressing audit storage capacity
- system audit records
- other relevant documents or records