Session audit is the heavy tool: recording what a user does during a session. AU-14 treats it as a capability you can switch on under defined conditions, with legal counsel involved.
NIST SP 800-53 Rev 5 binds US federal systems, and others through contract. For other organizations it is a reference.
What the control asks
Provide and implement the capability for defined users or roles to record, view, hear and log the content of a user session under circumstances you define. Develop, integrate and use session auditing in consultation with legal counsel and in accordance with applicable laws and policies.
NIST's guidance says session audits can include keystrokes, websites visited and file transfers. It is implemented in addition to event logging and may need specialized capture technology. Because it can reveal information about individuals and affect performance, organizations activate it in well defined situations, such as suspicion of a specific individual.
The enhancements are AU-14.1 System Start-up, AU-14.2 Capture and Record Content and AU-14.3 Remote Viewing and Listening.
What it means in practice
Most companies apply this to privileged sessions: bastion hosts, database admin access and production consoles. Decide which sessions, who authorizes recording and who can view it.
Evidence to collect
- A written policy on when session recording is used and who approves.
- Legal review sign off.
- Configuration of the recording tool and its access list.
- Examples of recorded sessions and their review, handled appropriately.
- Employee notice, where required.
Common gaps
- Recording turned on broadly with no legal review.
- Recordings accessible to too many people.
- No retention limit on recordings.
How to implement it
Scope recording to privileged access, publish a notice, restrict viewers and set short retention. Treat recordings as audit information under AU-9.
Quick check
Do we have to record every session?
No. The control asks for the capability and defined conditions for using it.
