In NIST SP 800-53 Rev 5, AU-15 (Alternate Audit Logging Capability) is withdrawn. The OSCAL catalog marks it as moved to AU-5.5, an enhancement of AU-5 titled Alternate Audit Logging Capability.
What changed
The idea did not disappear. Earlier revisions gave it its own control. Rev 5 folded it into the control about audit logging failures, so there is nothing to implement under the AU-15 number.
What it means in practice
If a customer questionnaire or older policy cites AU-15, answer it with your AU-5 evidence. The question is whether you have a backup way to keep logging if the main logging path fails.
Evidence to collect
- A description of the alternate path, such as a second collector, a local buffer or a second region.
- A test showing logs are captured when the primary path is down.
- The failure alert that triggers the switch.
Common gaps
- A secondary path that was never tested.
- Policies still citing the withdrawn number.
Sources
- NIST SP 800-53 Rev 5, AU-15 on the NIST CPRT catalog
- NIST SP 800-53 Rev 5 publication
- Withdrawn status and move to AU-5.5: OSCAL catalog, NIST SP 800-53 Rev 5.2.0
