AU-6(6)—Audit Review, Analysis, And Reporting
Technical
>Control Description
AUDIT REVIEW, ANALYSIS, AND REPORTING | CORRELATION WITH PHYSICAL MONITORING The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
>Supplemental Guidance
The correlation of physical audit information and audit logs from information systems may assist organizations in identifying examples of suspicious behaviour or supporting evidence of such behaviour. For example, the correlation of an individual’s identity for logical access to certain information systems with the additional physical security information that the individual was actually present at the facility when the logical access occurred, may prove to be useful in investigations.
>Tailoring Guidance
This security control/enhancement cannot be met using readily available Commercial-Off-The-Shelf (COTS) components. Consequently, implementation of this security control/enhancement may be somewhat problematic.
Ask AI
Configure your API key to use AI features.