AU-12(4) Query Parameter Audits of Personally Identifiable Information
Control enhancement of AU-12 Audit Record Generation
Control
Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
Discussion
Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel.
Need AU-12(4) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.