CVE-2021-32680

Audit policy requires defining and implementing logging of security-relevant events, directly reducing insufficient logging.

Providing proof of performed actions necessitates sufficient logging of security-relevant events with attribution details.

Retaining audit records for a defined period ensures security-relevant events remain available for after-the-fact investigations, directly mitigating the risk that attackers can hide actions due to missing or purged log data.

Directly requires generation of audit records for specified events, preventing the absence of logging that allows undetected malicious activity.

Directly implements detailed session logging to address the weakness of insufficient logging.

Provides alternate logging mechanism to maintain audit trails when primary capability fails, directly reducing insufficient logging.

Employing coordination mechanisms ensures consistent and sufficient logging practices are applied when audit information crosses organizational boundaries.

This control requires identifying, specifying, and justifying event types for logging with a focus on adequacy for post-incident investigations, directly mitigating insufficient logging.