AU-1 is the policy control for logging. It asks you to write down how audit logging works, who owns it and how often the document is reviewed.
NIST SP 800-53 Rev 5 binds US federal systems, and others through contract. Other organizations can treat it as a reference.
What the control asks
Develop, document and disseminate an audit and accountability policy covering purpose, scope, roles, responsibilities, management commitment, coordination among teams and compliance. It must be consistent with applicable laws and standards. Add procedures that carry out the policy and the AU controls. Name an official to manage both. Review and update the policy and the procedures at a frequency you define and after events you define.
What it means in practice
The policy states what the organization logs and why. The procedures say how: where logs go, who reviews them, how long they stay. NIST's guidance notes the policy can sit inside a general security policy, so a separate document is not required.
Evidence to collect
- The policy and procedures, with version and approval date.
- The named owner.
- Proof of distribution, such as an acknowledgment record.
- Review history showing the last review inside your stated interval.
Common gaps
- A policy that lists no event types or retention period.
- Procedures that do not match what the systems really do.
- A review date from years ago.
How to implement it
Write a two page policy that points to procedures for AU-2 through AU-12. Put the owner and review interval at the top. Calendar the review.
