NIST 800-53 r5 · Controls catalogue · Family AU
AU-6Audit Record Review, Analysis, and Reporting
Review and analyze system audit records {{ insert: param, au-06_odp.01 }} for indications of {{ insert: param, au-06_odp.02 }} and the potential impact of the inappropriate or unusual activity; Report findings to {{ insert: param, au-06_odp.03 }} ; and Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Last updated: 22 August 2026 07:11 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 11,000+ | Audit record review and analysis can detect unauthorized exposure or access to sensitive information. |
CWE-284 | Improper Access Control | 6,900+ | System audit review detects violations of access controls by identifying unauthorized access attempts. |
CWE-287 | Improper Authentication | 5,200+ | Review of authentication-related audit records can detect improper authentication mechanisms or bypasses. |
CWE-400 | Uncontrolled Resource Consumption | 3,800+ | Analysis identifies uncontrolled resource consumption indicative of denial-of-service or abuse attempts. |
CWE-269 | Improper Privilege Management | 3,400+ | Review helps detect improper privilege management by flagging unauthorized privilege changes or uses. |
CWE-285 | Improper Authorization | 1,500+ | Audit analysis reports findings of improper authorization, reducing the impact of such weaknesses. |
CWE-250 | Execution with Unnecessary Privileges | 300+ | Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-43033 UPD | 6.7 | 8.8 | 0.0098 | partial |
CVE-2026-52792 | 5.5 | 8.7 | 0.0043 | partial |
CVE-2025-3941 UPD | 4.4 | 5.4 | 0.0048 | partial |