Frameworks / NIST SP 800-53 Rev 5 / NIST800-AU-6 NIST SP 800-53 Rev 5
AU - Audit and Accountability
NIST SP 800-53 Rev 5 NIST800-AU-6: AU-6 Audit Record Review, Analysis, and Reporting a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; b. Report findings to [Assignment: organization-defined personnel or roles]; and c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 142 controls across 40 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AC-2(12) Account Monitoring for Atypical Usage AC-2(4) Automated Audit Actions AU-6 Audit Record Review, Analysis, and Reporting AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation AU-7(1) Automatic Processing CA-7 Continuous Monitoring CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4)) IR-1 Policy and Procedures SA-1 Policy and Procedures SI-4 System Monitoring SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(4) Inbound and Outbound Communications Traffic SI-4(5) System-Generated Alerts SI-7(7) Integration of Detection and Response AC-2(12) Account Monitoring for Atypical Usage AC-2(4) Automated Audit Actions AU-6 Audit Record Review, Analysis, and Reporting AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation AU-7(1) Automatic Processing CA-7 Continuous Monitoring CA-7(4) Continuous Monitoring | Risk Monitoring (CA-7(4)) IR-1 Policy and Procedures SA-1 Policy and Procedures SI-4 System Monitoring SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(4) Inbound and Outbound Communications Traffic SI-4(5) System-Generated Alerts SI-7(7) Integration of Detection and Response NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.AE-03 Information is correlated from multiple sources NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events NIST-CSF-DE.CM-06 External service provider activities and services are monitored to find potentially adverse events NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident NIST-CSF-RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated 10.2.1.2 10.2.1.2 Logs capture all administrative actions 10.2.1.6 10.2.1.6 Logs capture initialization and stopping of audit logs 10.4.1 10.4.1 Daily review of security-relevant logs 10.4.1.1 10.4.1.1 Automated mechanisms used for audit log review 10.4.2 10.4.2 Periodic review of all other system component logs 10.4.3 10.4.3 Exceptions and anomalies from log review addressed 12.10.5 12.10.5 Plan covers alerts from security monitoring systems 12.4.1 12.4.1 Executive responsibility for a PCI DSS compliance program 12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures 12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews CIS-13.1 Centralize Security Event Alerting CIS-13.11 Tune Security Event Alerting Thresholds CIS-17.9 Establish and Maintain Security Incident Thresholds CIS-3.14 Log Sensitive Data Access CIS-8.1 Establish and Maintain an Audit Log Management Process CIS-8.11 Conduct Audit Log Reviews CIS-8.2 Collect Audit Logs CIS-8.9 Centralize Audit Logs 5.7 Performance evaluation 5.7.1 Monitoring, measurement, analysis and evaluation 5.7.2 Internal audit 6.15 Compliance 6.15.2 Information security reviews 6.9.4 Logging and monitoring 6.9.7 Information systems audit considerations SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16) SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents SOC2-CC7.5 CC7.5 Recovering from security incidents 5.25 Assessment and decision on information security events 5.35 Independent review of information security 5.36 Compliance with policies, rules and standards for information security 8.15 Logging 8.16 Monitoring activities 5.25 Assessment and decision on information security events 5.28 Collection of evidence 5.35 Independent review of information security 5.36 Compliance with policies, rules and standards for information security 8.16 Monitoring activities ASBv3-IR-3 Detection and analysis - create incidents based on high-quality alerts ASBv3-IR-4 Detection and analysis - investigate an incident ASBv3-LT-1 Enable threat detection capabilities LT-5 Centralize security log management and analysis 9.1 Monitoring, measurement, analysis and evaluation 9.2 Internal audit 9.2.2 Audit programme(s) ASD37-28 Continuous incident detection and response (Excellent) ASD37-31 Hunt to discover incidents (Very Good) SEC04-BP02 Capture logs, findings, and metrics in standardized locations SEC04-BP03 Correlate and enrich security alerts C5-OPS-13 Logging and Monitoring - Identification of Events C5-OPS-16 Logging and Monitoring - Configuration 9.1 Monitoring, measurement, analysis and evaluation 9.2 Internal audit E8-APP-ML3 Application Control (ML3) ANSSI-HYG-36 Enable and Configure Logging on the Most Important Components CPS230-P30 Monitoring, Review and Testing of Control Effectiveness AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment AESCSF-SA-1 Logging and monitoring EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems 03.03.05 Audit Record Review, Analysis, and Reporting 3.11.3e Advanced Automation and Analytics Capabilities AU-6 AU-6 Audit Record Review, Analysis, and Reporting AU-6 AU-6 Audit Record Review, Analysis, and Reporting AU-6 AU-6 Audit Record Review, Analysis, and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in AU - Audit and Accountability You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done? NIST SP 800-53 Rev 5 NIST800-AU-6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 142 it maps to, and the evidence behind each claim, over MCP and REST.