When a request passes from your system to a vendor and back, whose log shows what happened? AU-16 asks you to agree on that before you need it.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For other organizations it is a reference.
What the control asks
Employ methods you define for coordinating defined audit information among external organizations when audit information is transmitted across organizational boundaries.
NIST's guidance says that using systems or services of external organizations requires a coordinated approach. Preserving the identity of individuals across boundaries can be hard and can carry performance and privacy costs. A common pattern is to capture the identity at the first system and have later systems record that the request came from an authorized individual. The enhancements are AU-16.1 Identity Preservation, AU-16.2 Sharing of Audit Information and AU-16.3 Disassociability.
What it means in practice
For SaaS and cloud providers, check what logs they give you and what they need from you. Agree on request identifiers so you can trace a transaction across both sides.
Evidence to collect
- Contract or agreement language on log sharing.
- Examples of correlated records using a shared request id.
- A list of provider logs you can access.
- Privacy review for identity data shared.
Common gaps
- Provider logs available but not enabled or collected.
- No shared identifiers.
- Nothing in contracts about log access during incidents.
How to implement it
Add request ids to outbound calls, turn on provider audit logs, and write log access into vendor agreements.
Quick check
Must we pass user identity to every vendor?
Not necessarily. NIST notes it is often enough that downstream systems record that the request came from an authorized individual.
