Frameworks / NIST SP 800-53 Rev 5 / NIST800-AU-12 NIST SP 800-53 Rev 5
AU - Audit and Accountability
NIST SP 800-53 Rev 5 NIST800-AU-12: AU-12 Audit Record Generation a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components]; b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and c. Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 135 controls across 57 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
10.2.1 10.2.1 Audit logging enabled on all system components 10.2.1.1 10.2.1.1 Logs capture individual user access to cardholder data 10.2.1.2 10.2.1.2 Logs capture all administrative actions 10.2.1.3 10.2.1.3 Access to the audit logs is itself logged 10.2.1.4 10.2.1.4 Logs capture invalid logical access attempts 10.2.1.5 10.2.1.5 Logs capture changes to identification and authentication credentials 10.2.1.6 10.2.1.6 Logs capture initialization and stopping of audit logs 10.2.1.7 10.2.1.7 Logs capture creation and deletion of system-level objects 11.5.2 11.5.2 Change detection on critical files 11.6.1 11.6.1 Payment page tamper detection 12.4.1 12.4.1 Executive responsibility for a PCI DSS compliance program 5.3.4 5.3.4 Anti-malware audit logs enabled and retained 8.2.4 8.2.4 User ID lifecycle changes authorized 9.2.3 9.2.3 Physical protection of network hardware and lines 9.4.4 9.4.4 Management approval for media leaving facility CIS-12.5 Centralize Network Authentication, Authorization, and Auditing (AAA) CIS-13.6 Collect Network Traffic Flow Logs CIS-3.14 Log Sensitive Data Access CIS-8.12 Collect Service Provider Logs CIS-8.2 Collect Audit Logs CIS-8.5 Collect Detailed Audit Logs CIS-8.6 Collect DNS Query Audit Logs CIS-8.7 Collect URL Request Audit Logs CIS-8.8 Collect Command-Line Audit Logs CIS-8.9 Centralize Audit Logs SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches SOC2-PI1.2 PI1.2 Controls over system inputs SOC2-PI1.3 PI1.3 Controls over system processing SOC2-PI1.4 PI1.4 Controls over output delivery SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs C5-OPS-10 Logging and Monitoring - Concept C5-OPS-15 Logging and Monitoring - Accountability C5-OPS-16 Logging and Monitoring - Configuration C5-PSS-04 Error handling and Logging Mechanisms AC-2(4) Automated Audit Actions AC-6(9) Log Use of Privileged Functions AU-12 Audit Record Generation CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records (CM-5(1)) AC-2(4) Automated Audit Actions AC-6(9) Log Use of Privileged Functions AU-12 Audit Record Generation CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records (CM-5(1)) 5.28 Collection of evidence 8.15 Logging 8.18 Use of privileged utility programs 8.4 Access to source code NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident NIST-CSF-RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved E8-ADMIN-ML2 Restrict Administrative Privileges (ML2) E8-APP-ML2 Application Control (ML2) E8-UAH-ML3 User Application Hardening - Maturity Level 3 BSI-28 Audit event logging and storage BSI-29 Audit record review and analysis BSI-31 Audit log protection and retention LT-3 Enable logging for security investigation LT-4 Enable network logging for security investigation A.6.2.8 AI system recording of event logs A.7 Data for AI systems ANSSI-HYG-36 Enable and Configure Logging on the Most Important Components SEC04-BP01 Configure service and application logging AWWA-4.4 Audit Logging and Monitoring AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment CAT-D3-2 Detective controls FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) 62351-14 Cyber security event logging 6.9.4 Logging and monitoring ISO27799-05 Audit trail for ePHI access ISO-25012-4.11 Traceability 27011-8.4 Logging and monitoring ISO27043-24 Logging and monitoring ISO21434-24 Logging and monitoring NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) AU-12 AU-12 Audit Record Generation AU-12 AU-12 Audit Record Generation AU-12 AU-12 Audit Record Generation NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC NISTSP88-7 Verification, Audit, Training, and Environmental/Safety Controls NISTSP92-5 Log Analysis: Correlation, Baselining, Anomaly Detection, Alerting, Manual Review ORANWG11-7 Logging, Monitoring, Incident Response, and Denial-of-Service Resilience OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management OSSFSC-7 Webhook Authentication, Contributors Diversity, Aggregate Score PASONE-4 Technical Security: CDE Configuration, BIM Tools, Encryption, Aggregation, Mobile Working PICSGMP-4 Chapter 4: Documentation - System, Record-Keeping, Data Integrity PTESPHASE-3 Threat Modeling SHAREASSESS-4 Vulnerability Management, Patching, Application Security SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule CISABD-1 Take Ownership of Customer Security Outcomes ISMSP-SYS-03 Security Monitoring and Log Management TSAPIPE-2 OT/IT Network Segmentation and Access Control Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in AU - Audit and Accountability You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done? NIST SP 800-53 Rev 5 NIST800-AU-12 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 135 it maps to, and the evidence behind each claim, over MCP and REST.