NIST 800-53 r5 · Controls catalogue · Family AU
AU-9Protection of Audit Information
Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and Alert {{ insert: param, au-09_odp }} upon detection of unauthorized access, modification, or deletion of audit information.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 5 mapping(s) from 2 framework(s): CSF 2.0 3 (partial) · ASVS 5.0 2 (full)
Implementations targeting this control (5)
- aws-config-s3-bucket-server-side-encryption-enabled S3 bucket has default server-side encryption AWS::S3::Bucket partial protect enforce
- aws-config-cloudtrail-enabled CloudTrail is enabled in the account AWS::CloudTrail::Trail partial detect enforce
- aws-config-cloud-trail-log-file-validation-enabled CloudTrail log file validation is enabled AWS::CloudTrail::Trail partial detect enforce CIS §3.2Hub CloudTrail.4
- aws-config-cloud-trail-encryption-enabled Cloud Trail Encryption Enabled AWS::CloudTrail::Trail partial detect enforce CIS §3.5Hub CloudTrail.2
- aws-config-s3-default-encryption-kms S3 Default Encryption Kms AWS::S3::Bucket partial protect enforce
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (3)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Protecting audit information prevents exposure of sensitive data contained within logs to unauthorized actors. |
CWE-284 | Improper Access Control | 5,367 | The control directly enforces access controls to prevent unauthorized access, modification, or deletion of audit information and tools. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-20440 | 8.0 | 7.5 | 0.5147 | good |
CVE-2025-27682 | 7.0 | 9.8 | 0.0065 | good |
CVE-2024-13513 | 7.0 | 9.8 | 0.0072 | good |
CVE-2026-4788 | 5.5 | 8.4 | 0.0012 | good |
CVE-2025-22960 | 5.5 | 8.0 | 0.0039 | good |
CVE-2026-28261 | 5.5 | 7.8 | 0.0011 | good |
CVE-2026-0383 | 5.5 | 7.8 | 0.0020 | good |
CVE-2023-22649 | 5.5 | 8.4 | 0.0188 | good |
CVE-2024-57957 | 3.5 | 6.6 | 0.0030 | good |
CVE-2026-27900 | 3.5 | 5.0 | 0.0047 | good |
CVE-2025-13315 | 7.0 | 9.8 | 0.3194 | good |
CVE-2024-48852 | 7.0 | 9.4 | 0.0237 | good |
CVE-2025-30424 | 7.0 | 9.8 | 0.0094 | good |
CVE-2025-11008 | 7.0 | 9.8 | 0.0044 | good |
CVE-2024-52975 | 7.0 | 9.0 | 0.0027 | good |
CVE-2026-0905 | 7.0 | 9.8 | 0.0022 | good |
CVE-2023-5003 | 6.0 | 7.5 | 0.2586 | good |
CVE-2024-21645 UPD | 6.0 | 5.3 | 0.2451 | good |
CVE-2026-22038 | 5.5 | 8.1 | 0.0043 | good |
CVE-2026-23775 | 5.5 | 7.6 | 0.0033 | good |
CVE-2024-8474 | 5.5 | 7.5 | 0.0053 | partial |
CVE-2025-67223 | 5.5 | 7.5 | 0.0063 | good |
CVE-2026-4276 UPD | 5.5 | 7.5 | 0.0028 | good |
CVE-2025-1075 | 5.5 | 7.5 | 0.0029 | good |
CVE-2025-26495 | 5.5 | 7.5 | 0.0031 | good |