FedRAMP Controls / AU
AU-5 Response to Audit Logging Process Failures
Family AU
Baselines moderate
Mapped KSIs 2
Control statement
a. Alert {{ insert: param, au-05_odp.01 }} within {{ insert: param, au-05_odp.02 }} in the event of an audit logging process failure; and
b. Take the following additional actions: {{ insert: param, au-05_odp.03 }}. Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is
preserved in the catalog database.
Covered by these Key Security Indicators
| KSI | Title | Category |
|---|---|---|
| KSI-AFR-05 | Significant Change Notifications Determine how significant changes will be tracked and how all necessary parties will be notified in alignment with the FedRAMP Significant Change Notifications (SCN) process and persistently address all related requirements and recommendations. | Authorization by FedRAMP |
| KSI-MLA-01 | Security Information and Event Management (SIEM) Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistent logging of events, activities, and changes. | Monitoring, Logging, and Auditing |