Response to Audit Logging Process Failures | AU-5

Description

Logging failures include an application or operating system failing to log events, a failure to send events to the central logging system or a failure of the central logging system itself.

Information Resource Owners or their designees, including the owner of the centralized logging system, are responsible for:

• specifying appropriate monitoring for logging failures for the systems under their authority;
• defining audit alert thresholds for the systems under their authority; and
• designating appropriate contacts to receive alerts for the systems under their authority.

Last updated: 5/12/2026