Question

Based on NIST SP 800-53 Rev 4 Appendix F: Security Control Catalog - AU: Audit and Accountability, how can auditing and accountability enhance the overall architectural design of an information technology infrastructure? Please provide specific examples.

Answer 1

NIST Special Publication 800-53,Revision 4 provides a catalog of security controls for federal information systems and organisations and assessment procedures.

The NITS 800-53 Publication also describes how to develop specialized sets of controls,or overlays,tailored for specific types of missions functions,technologies,or environments of operation.

MPMG reviewed information security practices,policies and produces at the DOI office of the chief information officer and the following 11 DOI bureaus and offices:

Bureaus of Indian affairs

Bureaus of land management

Bureaus of reclamation

Bureaus of safety and environmental enforcement

US fish and wildlife service

National park service

How to manage a successful audit

Establish a security baseline through annual audits.

Spell out your objectives

Choose auditors with"real" security experience.

Involve business unit managers early.

Make sure auditors rely on experience,not just checklist.

Insist that the auditor 's report reflects your oryourzation's risk.

The letter transmits the revised Government Accountability office.

An audit is an independent review and examination of records and activities to assess the adequacy of system controls and ensure compliance with established policies and operational procedures.

Audit trials may be used an a support for regular system operations,a kind of insurance policy,or both.

Example of Audit and Accountability controls include:audit events,time stamps, non-repudiation ,protection of audit information,audit record retention,and session audit.

Thank you,I hope it is helpful for you.