AU-6 Audit Record Review, Analysis, and Reporting

Family AU

Baselines moderate

Mapped KSIs 2

Control statement

a. Review and analyze system audit records {{ insert: param, au-06_odp.01 }} for indications of {{ insert: param, au-06_odp.02 }} and the potential impact of the inappropriate or unusual activity;
    b. Report findings to {{ insert: param, au-06_odp.03 }} ; and
    c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
        Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. In multi-tenant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSI	Title	Category
KSI-AFR-03	Authorization Data Sharing Determine how authorization data will be shared with all necessary parties in alignment with the FedRAMP Authorization Data Sharing (ADS) process and persistently address all related requirements and recommendations.	Authorization by FedRAMP
KSI-MLA-02	Audit Logging _Persistently_ review and audit logs.	Monitoring, Logging, and Auditing