AU-2 chooses the events. AU-12 makes sure the systems actually produce them.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For other organizations it is a reference.
What the control asks
Provide audit record generation capability for the event types the system can audit, as defined in AU-2a, on the components you define. Allow defined personnel or roles to select which event types are logged by specific components. Generate audit records for the event types defined in AU-2c, with the content defined in AU-3.
What it means in practice
For every system in scope, there is a switch that turns on logging and a person who may flip it. NIST's guidance notes that audit records can come from many components and that the AU-2 list is a subset of everything a system can log.
Enhancements named in the record are AU-12.1 System-wide and Time-correlated Audit Trail, AU-12.2 Standardized Formats, AU-12.3 Changes by Authorized Individuals and AU-12.4 Query Parameter Audits of Personally Identifiable Information.
Evidence to collect
- A matrix of components against event types with the logging status.
- Configuration exports from cloud accounts, databases and applications.
- Test results showing each event type produces a record.
- A list of who may change logging settings.
Common gaps
- Logging enabled in production but not in staging or a new region.
- Database or object storage access logs never turned on.
- Anyone with admin rights can disable logging unnoticed.
- Content missing the AU-3 fields.
How to implement it
Use infrastructure as code to enable logging by default, restrict who can change it, and run a periodic check that compares your matrix with real settings.
Quick check
How do we show logging is on everywhere?
Export configuration for each account and component, compare it to your matrix, and keep the dated result.
