| Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.
Rationale for non-applicability: This vulnerability is better addressed by another CCI. CCI-000130 covers audit records to a sufficient degree for the MDM server. |
