20.13 Ensure 'Audit records must be backed up to a different system or media than the system being audited'

Information

This policy setting ensures that audit records are backed up to a different system or media than the system being audited.

Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Establish and implement a process for backing up log data to another system or media other than the system being audited.

Impact:

A secondary system that has enough resources to store large amounts of log data will be needed.

See Also

https://workbench.cisecurity.org/benchmarks/15301

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c.

Plugin: Windows

Control ID: 31491abf77f28698168866ac44492cef877c50ce90134e9c9daa97d1be9ba5d6