NIST 800-53 r5 · Controls catalogue · Family AU
AU-6Audit Record Review, Analysis, and Reporting
Review and analyze system audit records {{ insert: param, au-06_odp.01 }} for indications of {{ insert: param, au-06_odp.02 }} and the potential impact of the inappropriate or unusual activity; Report findings to {{ insert: param, au-06_odp.03 }} ; and Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Last updated: 04 July 2026 08:17 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 10 mapping(s) from 1 framework(s): CSF 2.0 10 (mostly)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,506 | Audit record review and analysis can detect unauthorized exposure or access to sensitive information. |
CWE-284 | Improper Access Control | 5,385 | System audit review detects violations of access controls by identifying unauthorized access attempts. |
CWE-287 | Improper Authentication | 4,909 | Review of authentication-related audit records can detect improper authentication mechanisms or bypasses. |
CWE-400 | Uncontrolled Resource Consumption | 3,573 | Analysis identifies uncontrolled resource consumption indicative of denial-of-service or abuse attempts. |
CWE-269 | Improper Privilege Management | 3,104 | Review helps detect improper privilege management by flagging unauthorized privilege changes or uses. |
CWE-285 | Improper Authorization | 1,360 | Audit analysis reports findings of improper authorization, reducing the impact of such weaknesses. |
CWE-250 | Execution with Unnecessary Privileges | 333 | Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-48172 KEV UPD | 10.0 | 9.8 | 0.1891 | good |
CVE-2026-40193 | 5.5 | 8.2 | 0.0042 | partial |
CVE-2026-4276 UPD | 5.5 | 7.5 | 0.0028 | partial |
CVE-2024-2240 | 5.5 | 7.2 | 0.0047 | good |
CVE-2026-33665 | 5.5 | 7.5 | 0.0032 | partial |