| 1. The system administrator shall select security events within the auditing capability that can be provided by the system components in accordance with DISA STIGs for auditing related to operating system, database, and application. |
2. The system administrator shall configure each audit event to record sufficient information in the audit trails such as date/time of the event, user ID, source, target, type of event, and success/failure.
3. The system administrator shall test the auditing capability to ensure that the audit trails record required security events; each event contains sufficient information to support security investigation; and the auditing capability does not affect system operations.