AU-5 (2)

AU-5 (2) H

The information system provides an alert in [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit failure events requiring real-time alerts].

  • H AU-5 (2)-1 [real-time] AU-5 (1)-2 [service provider personnel with authority to address failed audit events] AU-5 (1)-3 [audit failure events requiring real-time alerts, as defined by organization audit policy].
Supplemental Guidance

Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less).