Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

au-9

protection of audit information  

assessment objective:

Determine if:

au-9[1]

the information system protects audit information from unauthorized:

au-9[1][a]

access;

au-9[1][b]

modification;

au-9[1][c]

deletion;

au-9[2]

the information system protects audit tools from unauthorized:

au-9[2][a]

access;

au-9[2][b]

modification; and

au-9[2][c]

deletion.

potential assessment methods and objects:

Examine: [select from: Audit and accountability policy; access control policy and procedures; procedures addressing protection of audit information; information system design documentation; information system configuration settings and associated documentation, information system audit records; audit tools; other relevant documents or records].

Interview: [select from:  Organizational personnel with audit and accountability responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers].

Test: [select from: Automated mechanisms implementing audit information protection].