[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fau-2":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","au-2","AU-2","Event Logging",167,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must identify which event types systems can log, coordinate this with others who need the data, decide which events are logged and how often, explain why those events support investigations, and review the selection periodically.\n\n**In practice.** This produces a logging standard listing required events such as authentication, privilege use, configuration changes, access to sensitive data and security tool alerts, per system type. Security, operations and legal or privacy stakeholders should agree it. Auditors expect the standard, a rationale and evidence of periodic review. CIS Control 8 offers a practical baseline.\n\n**Common gaps.** Event selection is often left to product defaults with no conscious decision. Logging standards are rarely revisited when new platforms are adopted.","a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types];\n  b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;\n  c. Specify the following event types for logging within the system: [Assignment: organization-defined organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type];\n  d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and\n  e. Review and update the event types selected for logging [Assignment: organization-defined frequency].\nDiscussion: An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system.\n\nTo balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage.\n\nEvent logging requirements, including the need to log specific event types, may be referenced in other controls and control enhancements. These include [AC-2(4)](#ac-2.4), [AC-3(10)](#ac-3.10), [AC-6(9)](#ac-6.9), [AC-17(1)](#ac-17.1), [CM-3f](#cm-3_smt.f), [CM-5(1)](#cm-5.1), [IA-3(3)(b)](#ia-3.3_smt.b), [MA-4(1)](#ma-4.1), [MP-4(2)](#mp-4.2), [PE-3](#pe-3), [PM-21](#pm-21), [PT-7](#pt-7), [RA-8](#ra-8), [SC-7(9)](#sc-7.9), [SC-7(15)](#sc-7.15), [SI-3(8)](#si-3.8), [SI-4(22)](#si-4.22), [SI-7(8)](#si-7.8) , and [SI-10(1)](#si-10.1) . Organizations include event types that are required by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. Audit records can be generated at various levels, including at the packet level as information traverses the network. Selecting the appropriate level of event logging is an important part of a monitoring and auditing capability and can identify the root causes of problems. When defining event types, organizations consider the logging necessary to cover related event types, such as the steps in distributed, transaction-based processes and the actions that occur in service-oriented architectures.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"cross-jurisdictional-law-enforcement-surveillance-of-political-activists-raises-civil-liberties-alar","Cross-Jurisdictional Law Enforcement Surveillance of Political Activists Raises Civil Liberties Alarms","2026-10-16T20:20:31.596+00:00",{"slug":25,"title":26,"published_at":27},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":29,"title":30,"published_at":31},"ai-models-act-autonomously-to-bypass-auth-and-raid-crypto-wallets","AI Models Act Autonomously to Bypass Auth and Raid Crypto Wallets","2026-10-16T12:21:09.736+00:00",{"slug":33,"title":34,"published_at":35},"uk-legal-aid-agency-breach-exposes-47-years-of-sensitive-records","UK Legal Aid Agency Breach Exposes 47 Years of Sensitive Records","2026-10-15T16:20:35.876+00:00",{"slug":37,"title":38,"published_at":39},"international-csam-crackdown-highlights-platform-accountability-and-reporting-gaps","International CSAM Crackdown Highlights Platform Accountability and Reporting Gaps","2026-10-15T12:20:23.726+00:00",{"slug":41,"title":42,"published_at":43},"shadow-ai-on-endpoints-creates-hidden-risk-and-data-exposure","Shadow AI on Endpoints Creates Hidden Risk and Data Exposure","2026-10-13T12:22:02.053+00:00",{"slug":45,"title":46,"published_at":47},"ai-coding-agents-require-dedicated-endpoint-visibility-and-forensic-controls","AI Coding Agents Require Dedicated Endpoint Visibility and Forensic Controls","2026-10-12T12:21:09.449+00:00",{"slug":49,"title":50,"published_at":51},"anthropic-disables-ai-internet-access-after-claude-exploits-injection-flaws-in-live-systems","Anthropic Disables AI Internet Access After Claude Exploits Injection Flaws in Live Systems","2026-10-10T10:20:22.03+00:00",{"slug":53,"title":54,"published_at":55},"ai-agents-are-the-new-bec-target-social-engineering-evolves","AI Agents Are the New BEC Target: Social Engineering Evolves","2026-10-09T14:20:26.055+00:00",{"slug":57,"title":58,"published_at":59},"exchange-privilege-escalation-flaw-exposes-user-mailboxes","Exchange Privilege Escalation Flaw Exposes User Mailboxes","2026-10-05T18:20:52.501+00:00",{"slug":61,"title":62,"published_at":63},"ai-desktop-agents-demand-strict-permission-controls","AI Desktop Agents Demand Strict Permission Controls","2026-10-04T00:20:21.907+00:00",{"slug":65,"title":66,"published_at":67},"shinyhunters-member-detained-cooperating-with-fbi-after-alleged-breach","ShinyHunters Member Detained, Cooperating with FBI After Alleged Breach","2026-10-03T20:20:20.063+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",47,{"slug":75,"name":76,"problem":77,"stories":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",39,{"slug":80,"name":81,"problem":82,"stories":83},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",34,{"slug":85,"name":86,"problem":87,"stories":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",32,{"slug":90,"name":91,"problem":92,"stories":88},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":94,"name":95,"problem":96,"stories":97},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",21,[99,105,110,115,119,124,129,132],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","8","Control 8","Audit Log Management",120,{"family":100,"item":106,"code":107,"title":108,"together":109},"6","Control 6","Access Control Management",87,{"family":5,"item":111,"code":112,"title":113,"together":114},"ac-2","AC-2","Account Management",81,{"family":5,"item":116,"code":117,"title":118,"together":114},"ac-6","AC-6","Least Privilege",{"family":120,"item":121,"code":122,"title":122,"together":123},"itil","overview","ITIL",76,{"family":100,"item":125,"code":126,"title":127,"together":128},"3","Control 3","Data Protection",56,{"family":100,"item":130,"code":131,"title":113,"together":128},"5","Control 5",{"family":133,"item":134,"code":135,"title":136,"together":137},"gdpr","32","Article 32","Security of processing",55]