Audit Record Review, Analysis, and Reporting AU-6

Audit and Accountability · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AU-6 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-6 (Audit Record Review, Analysis, and Reporting) is the human side of logging: someone actually reads the logs on a defined schedule, looks for unusual or improper activity, and reports what they find to the right people. Logs no one reviews are not accountability. It is part of the Moderate baseline.

What good looks like

Review and analyze audit records on a defined frequency, not just when something breaks.
Look specifically for inappropriate, unusual, or unauthorized activity.
Assign a named owner who is responsible for the review.
Report findings to designated people who can act on them.
Adjust the depth or frequency of review when risk or threat information changes.

Framework mapping

NIST CSF 2.0 — DE.AE-02 — Detected events are analyzed to understand attack targets and methods
CIS Controls v8 — Control 8.11 — Conduct audit log reviews

How to move it toward Implemented

The tooling is present — aureport summaries, the PlumbWatch dashboard, Suricata's fast.log, and fail2ban-client status — but nobody is assigned to read them on a schedule, so AU-6 is only partial.
Close the gap by documenting a review cadence (for example, a weekly aureport and fast.log review), naming the owner who performs it, and defining who findings are reported to.
Run that review, save each one as a dated file, and attach it as asset-scoped evidence naming AU-6 — a repeating log of reviews is what moves this from partial toward Completed.