Transfer to Alternate Storage
LOW MODERATE HIGHRequirements NIST SOURCE
Transfer audit logs [frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Discussion (NIST Supplemental Guidance)
Audit log transfer, also known as off-loading, is a common process in systems with limited audit log storage capacity and thus supports availability of the audit logs. The initial audit log storage is only used in a transitory fashion until the system can communicate with the secondary or alternate system allocated to audit log storage, at which point the audit logs are transferred. Transferring audit logs to alternate storage is similar to AU-9(2) in that audit logs are transferred to a different entity. However, the purpose of selecting AU-9(2) is to protect the confidentiality and integrity of audit records. Organizations can select either control enhancement to obtain the benefit of increased audit log storage capacity and preserving the confidentiality, integrity, and availability of audit records and logs.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for AU-4(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- the frequency of audit logs transferred to a different system, system component, or media other than the system or system component conducting the logging is defined;
- audit logs are transferred <AU-04(01)_ODP frequency> to a different system, system component, or media other than the system or system component conducting the logging.
Examine
[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit storage capacity; procedures addressing transfer of system audit records to secondary or alternate systems; system design documentation; system configuration settings and associated documentation; logs of audit record transfers to secondary or alternate systems; system audit records transferred to secondary or alternate systems; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with audit storage capacity planning responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators].
Test
[SELECT FROM: Mechanisms supporting the transfer of audit records onto a different system].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for AU-4(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Audit and accountability policy
- system security plan
- privacy plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Logging
- logs of audit record transfers to secondary or alternate systems
Testing
- Mechanisms supporting the transfer of audit records onto a different system
Other Records
- procedures addressing audit storage capacity
- procedures addressing transfer of system audit records to secondary or alternate systems
- system audit records transferred to secondary or alternate systems
- other relevant documents or records