When an incident happens you need to search millions of records quickly, and you need to trust that the search did not change them. That is AU-7.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. Other organizations can use it as a reference.
What the control asks
Provide a record reduction and report generation capability that supports on-demand review, analysis and reporting and after-the-fact investigations, and that does not alter the original content or time ordering of audit records.
What it means in practice
NIST's guidance describes reduction as organizing collected log data into a summary that is more meaningful to analysts. The enhancements are AU-7.1 Automatic Processing and AU-7.2 Automatic Sort and Search. Time ordering can be a problem if timestamps are too coarse, which ties this control to AU-8.
Evidence to collect
- Screenshots or exports of saved searches and reports.
- Proof that queries run on a copy or index, with raw logs kept intact.
- A sample investigation report built from logs.
Common gaps
- Analysts editing or filtering the only copy of the logs.
- No saved reports, so every investigation starts from scratch.
- Timestamps too coarse to order events.
How to implement it
Keep raw logs immutable, query through an index or search tool, and save common reports.
