AU-6 (3) - Audit Review, Analysis, And Reporting | Correlate Audit Repositories

Description	The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
Guidance	Organization-wide situational awareness includes awareness across all three tiers of risk management (i.e., organizational, mission/business process, and information system) and supports cross-organization awareness. Related controls: AU-12, IR-4.
Confidentiality Impact Threshold	low
Integrity Impact Threshold	low
Availability Impact Threshold	none

CCI-000153

Description	The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
Assessment Procedure	AU-6(3).1
Organization Guidance	The organization being inspected/assessed documents and implements a process to analyze and correlate audit records across different repositories to gain organization-wide situational awareness. The organization must maintain a record of the analysis.
Auditor Guidance	The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of analysis to ensure the organization being inspected/assessed analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.