Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

au-16

cross-organizational auditing  

assessment objective:

Determine if the organization:

au-16[1]

defines audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries;

au-16[2]

defines methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries; and

au-16[3]

employs organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries.

potential assessment methods and objects:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing methods for coordinating audit information among external organizations; information system design documentation; information system configuration settings and associated documentation; methods for coordinating audit information among external organizations; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for coordinating audit information among external organizations; organizational personnel with information security responsibilities].

Test: [select from: Automated mechanisms implementing cross-organizational auditing (if applicable)].