Audit trail records from all available sources are regularly reviewed for indications of inappropriate or unusual activity. Suspected violations of IA policies are analyzed and reported in accordance with DoD information system IA procedures.
|MAC / CONF||Impact||Subject Area|
|Low||Enclave Computing Environment|
|If audit trails that record security events are not reviewed regularly, security violations of the system cannot be detected and prevented in a timely manner. This implementation guide is aimed to help system administrators detect security violations in a timely manner.|
| 1. The project manager shall designate authorized personnel (IAM/IAO) in writing who can review audit trails regularly (e.g., daily, weekly) to monitor and detect any anomalies and unusual user activities. |
2. The system administrator shall generate audit trails and distribute them as planned to the ISSO for review.
3. The system administrator also shall review the online audit trails and analyze the security violations and report minor and/or major security incident to ISSO in accordance with the system’s Incident Response Plan and the Standard Operating Procedures.