Control statement
Ensure that audit records contain information that establishes the following:
- a.What type of event occurred;
- b.When the event occurred;
- c.Where the event occurred;
- d.Source of the event;
- e.Outcome of the event; and
- f.Identity of any individuals, subjects, or objects/entities associated with the event.
Discussion
Audit record content that may be necessary to support the auditing function includes event descriptions (item a), time stamps (item b), source and destination addresses (item c), user or process identifiers (items d and f), success or fail indications (item e), and filenames involved (items a, c, e, and f) . Event outcomes include indicators of event success or failure and event-specific results, such as the system security and privacy posture after the event occurred. Organizations consider how audit records can reveal information about individuals that may give rise to privacy risks and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the trail records inputs or is based on patterns or time of usage.
From control text to operational evidence
Use Content of Audit Records as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to audit event design, trustworthy collection, retention, review, and investigation support.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- logging standards and event-selection decisions
- sample audit records and retention settings
- time-synchronization evidence
- alert and review records
Common failure patterns
- collecting logs without defined use cases
- critical events missing from the audit trail
- retention shorter than investigative needs
- logs accessible to the same administrators being monitored
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- AU-03a.audit records contain information that establishes what type of event occurred;
- AU-03b.audit records contain information that establishes when the event occurred;
- AU-03c.audit records contain information that establishes where the event occurred;
- AU-03d.audit records contain information that establishes the source of the event;
- AU-03e.audit records contain information that establishes the outcome of the event;
- AU-03f.audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing content of audit records
- system design documentation
- system configuration settings and associated documentation
- list of organization-defined auditable events
- system audit records
- system incident reports
- other relevant documents or records
Interview
- Organizational personnel with audit and accountability responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
Test
- Mechanisms implementing system auditing of auditable events
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Related defensive techniques
D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
AU-3(1) — Additional Audit Information
Generate audit records containing the following additional information: [Organization-defined: additional information].
Official discussion
The ability to add information generated in audit records is dependent on system functionality to configure the audit record content. Organizations may consider additional information in audit records including, but not limited to, access control or flow control rules invoked and individual identities of group account users. Organizations may also consider limiting additional audit record information to only information that is explicitly needed for audit requirements. This facilitates the use of audit trails and audit logs by not including information in audit records that could potentially be misleading, make it more difficult to locate information of interest, or increase the risk to individuals' privacy.
Organization-defined parameters (1)
Assessment objectives and methods
generated audit records contain the following [Organization-defined: additional information].
Examine
- Audit and accountability policy
- procedures addressing content of audit records
- system security plan
- privacy plan
- system design documentation
- system configuration settings and associated documentation
- list of organization-defined auditable events
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with audit and accountability responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- system audit capability
AU-3(2) — Centralized Management of Planned Audit Record Content
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
AU-3(3) — Limit Personally Identifiable Information Elements
Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Organization-defined: elements].
Official discussion
Limiting personally identifiable information in audit records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system.
Organization-defined parameters (1)
Assessment objectives and methods
personally identifiable information contained in audit records is limited to [Organization-defined: elements] identified in the privacy risk assessment.
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- privacy risk assessment
- privacy risk assessment results
- procedures addressing content of audit records
- system design documentation
- system configuration settings and associated documentation
- list of organization-defined auditable events
- system audit records
- third party contracts
- other relevant documents or records
Interview
- Organizational personnel with audit and accountability responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- system audit capability
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.