20.39 Ensure 'Off-load of audit records of interconnected systems in real time and off-load standalone systems weekly'

Information

This policy setting ensures that at a minimum, audit records of interconnected systems are off-loaded in real time and stand-alone system audit records are off-loaded at least weekly.

Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure the system to, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.

Impact:

A secondary system that has enough resources to store large amounts of log data will be needed.

See Also

https://workbench.cisecurity.org/benchmarks/15105

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6(3), CSCv7|6.5

Plugin: Windows

Control ID: 6a7b9ca8abf329e4cd169cdfa22c337ec0e81d09a4324d3a515d6a0a596a47fc