NIST 800-53 AU (Audit and Accountability): Logging Requirements for SIEM

Family Scope (SP 800-53 Revision 5)

Identifiers AU-1 through AU-16. AU-15 is withdrawn in Rev 5 (moved to AU-5(5)). Official titles:

SIEM-Relevant Emphasis

• AU-2 / AU-12 — define and generate the event set (not “log everything”)
• AU-3 / AU-8 — content plus synchronized time for correlation
• AU-6 / AU-7 — review, analysis, reduction, on-demand reporting
• AU-5 / AU-9 / AU-11 — failure response, integrity and protection, retention

SP 800-53B baselines select which AU controls and enhancements apply — do not implement the entire family blindly.

How CyberSilo Helps

• ThreatHawk SIEM — generation, correlation, alerting, and retention evidence
• Compliance Standards Automation — map AU controls to SSP and assessment artefacts

Frequently Asked Questions

Does AU require a named SIEM product?

No. Outcomes matter. SIEM is a common implementation pattern for AU-6, AU-7, and AU-12, not a product mandate.

Is AU-15 still assessed?

No. In SP 800-53 Revision 5, AU-15 is withdrawn and moved under AU-5 enhancements.

How does AU relate to 800-171 3.3?

800-171 Audit and Accountability requirements are derived from selected 800-53 AU controls for nonfederal CUI systems.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · ThreatHawk SIEM