[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fau-3":3},{"item":4,"lessons":18,"controls":44,"related":70},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","au-3","AU-3","Content of Audit Records",6,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Audit records must contain enough information to establish what type of event occurred, when and where it occurred, its source, its outcome and the identity of any individuals, subjects or objects involved.\n\n**In practice.** This means checking that log formats from key systems include timestamps with time zone, user and system identifiers, source addresses and success or failure fields, and normalising them in the logging platform. Synchronised time across systems is essential. Auditors look for sample records, parsing configurations and time synchronisation settings. Privacy rules should guide what personal data appears in logs.\n\n**Common gaps.** Logs from custom applications often lack user identity or outcome. Inconsistent time zones and unsynchronised clocks make event correlation unreliable. Logs may also contain too much, such as passwords or personal data.","Ensure that audit records contain information that establishes the following:\n  a. What type of event occurred;\n  b. When the event occurred;\n  c. Where the event occurred;\n  d. Source of the event;\n  e. Outcome of the event; and\n  f. Identity of any individuals, subjects, or objects\u002Fentities associated with the event.\nDiscussion: Audit record content that may be necessary to support the auditing function includes event descriptions (item a), time stamps (item b), source and destination addresses (item c), user or process identifiers (items d and f), success or fail indications (item e), and filenames involved (items a, c, e, and f) . Event outcomes include indicators of event success or failure and event-specific results, such as the system security and privacy posture after the event occurred. Organizations consider how audit records can reveal information about individuals that may give rise to privacy risks and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the trail records inputs or is based on patterns or time of usage.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"300k-gdpr-fine-for-mishandling-75-of-erasure-requests","€300K GDPR Fine for Mishandling 75% of Erasure Requests","2026-09-29T14:20:25.731+00:00",{"slug":25,"title":26,"published_at":27},"italian-sports-facility-fined-8000-for-unlawful-cctv-surveillance-of-pool-users","Italian Sports Facility Fined €8,000 for Unlawful CCTV Surveillance of Pool Users","2026-09-14T14:21:29.034+00:00",{"slug":29,"title":30,"published_at":31},"gdpr-fine-issued-for-unlawful-sharing-of-employee-audio-recording","GDPR Fine Issued for Unlawful Sharing of Employee Audio Recording","2026-09-10T16:20:41.933+00:00",{"slug":33,"title":34,"published_at":35},"italian-dpa-fines-company-460k-for-unlawful-employee-email-monitoring","Italian DPA Fines Company €460K for Unlawful Employee Email Monitoring","2026-08-10T08:20:19.441+00:00",{"slug":37,"title":38,"published_at":39},"apples-hide-my-email-bug-leaked-real-addresses-in-mail-logs-for-over-a-year","Apple's Hide My Email Bug Leaked Real Addresses in Mail Logs for Over a Year","2026-07-21T22:20:40.838+00:00",{"slug":41,"title":42,"published_at":43},"ai-tool-credential-compromise-exposes-oauth-token-risks","AI Tool Credential Compromise Exposes OAuth Token Risks","2026-04-21T00:09:24.366+00:00",[45,50,54,58,62,66],{"slug":46,"name":47,"problem":48,"stories":49},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":51,"name":52,"problem":53,"stories":49},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":55,"name":56,"problem":57,"stories":49},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":59,"name":60,"problem":61,"stories":49},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":63,"name":64,"problem":65,"stories":49},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":67,"name":68,"problem":69,"stories":49},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,77,82,87,91,96,101,106],{"family":72,"item":73,"code":74,"title":75,"together":76},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",5,{"family":78,"item":79,"code":80,"title":81,"together":76},"cis","3","Control 3","Data Protection",{"family":72,"item":83,"code":84,"title":85,"together":86},"13","Article 13","Information to be provided where personal data are collected from the data subject",3,{"family":72,"item":88,"code":89,"title":90,"together":86},"6","Article 6","Lawfulness of processing",{"family":92,"item":93,"code":94,"title":95,"together":86},"iso-27001","a-5-34","Annex A 5.34","ISO\u002FIEC 27001:2022 Annex A 5.34: Privacy and protection of PII",{"family":97,"item":98,"code":99,"title":100,"together":86},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",{"family":78,"item":102,"code":103,"title":104,"together":105},"8","Control 8","Audit Log Management",2,{"family":72,"item":107,"code":108,"title":109,"together":105},"9","Article 9","Processing of special categories of personal data"]