Event Logging AU-2

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-2 (Event Logging) is about deciding what a system should record. The organization identifies the event types the system can log, coordinates the logging function across components, and specifies which events must actually be captured — and why — so activity can be reconstructed after the fact. It carries from the Low baseline into Moderate.

What good looks like

• Identify the event types the system is capable of logging, and select which ones must be captured.
• Write down the rationale — why each selected event matters for spotting or investigating trouble.
• Coordinate logging across the system so the selected events are captured wherever they occur.
• Make sure the selected set supports after-the-fact investigation of security incidents.
• Review and update the list of logged events on a schedule as the system and its threats change.

Framework mapping

• NIST CSF 2.0 — PR.PS-04 — Log records are generated and made available for continuous monitoring
• CIS Controls v8 — Control 8 — Audit Log Management

How to move it toward Implemented

• This is met on VM 607: auditd (the Linux Audit daemon) is enabled at boot, and /etc/audit/rules.d/blue.rules selects the events to capture — watches on /etc/passwd, /etc/shadow, /etc/sudoers, and /etc/ssh/sshd_config, plus a rule logging every command run as root.
• To reach 'Completed,' attach the as-built capture showing auditd: active and the loaded rules (auditctl -l) as asset-scoped evidence, naming AU-2 in the Requirement field.
• One documentation gap worth closing: write a short note listing the selected event types and the rationale for each — that is the AU-2 paperwork behind the working mechanism.