// definition
Audit log
An event record used to examine how a system was used
Short definition
A record of events useful for examining a system: access, activation of a function, permission changes or delivery of data. Its value depends on the events collected, their timestamps and protection against unauthorized changes or deletion. Separate storage and distinct administration rights help preserve the evidence when a system is compromised.
risk atlas
Knowledge map
Related analyses
Primary sources
- NIST, SP 800-53, revision 5NIST SP 800-53, revision 5: AU-9 and enhancements (2) and (4), protecting audit information, separate storage and restricted administration.