Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
ECAT-1 Audit Trail, Monitoring, Analysis and Reporting
Overview
Audit trail records from all available sources are regularly reviewed for indications of inappropriate or unusual activity. Suspected violations of IA policies are analyzed and reported in accordance with DoD information system IA procedures.
| MAC / CONF | Impact | Subject Area |
|---|---|---|
| SENSITIVE PUBLIC MACIII | Low | Enclave Computing Environment |
Details
| Threat |
|---|
| If audit trails that record security events are not reviewed regularly, security violations of the system cannot be detected and prevented in a timely manner. This implementation guide is aimed to help system administrators detect security violations in a timely manner. |
| Guidance |
|---|
| 1. The project manager shall designate authorized personnel (IAM/IAO) in writing who can review audit trails regularly (e.g., daily, weekly) to monitor and detect any anomalies and unusual user activities. 2. The system administrator shall generate audit trails and distribute them as planned to the ISSO for review. 3. The system administrator also shall review the online audit trails and analyze the security violations and report minor and/or major security incident to ISSO in accordance with the system’s Incident Response Plan and the Standard Operating Procedures. |
References
- CJCSM 6510.01, Defense-in-Depth: Information Assurance (IA) and Computer Network Defense (CND), 10 August 2004
- System or Organization-specific Standard Operating Procedures and Incident Response Plan