NIST SP 800-53 Rev. 5 · Audit and Accountability
AU-12 — Audit Record Generation
Required audit logging not enabled. Published queries for three platforms, each with the evidence it needs and the limits of what it shows.
Why this matters
A system that is supposed to be recording events and is silently recording nothing
Organizations decide which systems must keep an event record, and then assume the arrangement holds. Recording breaks quietly: an agent stops running, a setting is lost during a rebuild, a new system is created without it. Nothing raises an alarm, because the absence of records looks identical to the absence of activity.
Why this check earns its place. Silence is the hardest failure to notice, because there is nothing to see. This check compares what should be reporting against what actually is, which is the only way the gap becomes visible.
- What it reads
- The organization's own list of systems that must keep records, compared against what is actually arriving.
- What it reports
- Systems declared as requiring an event record that have produced none during the period examined.
See related public disclosures on the Signals page →
The requirement
The organization must provide audit record generation capability for the event types the system is capable of auditing, on all components that require auditing.
NIST SP 800-53 Rev. 5 — AU-12 (Audit Record Generation).
NIST requires audit generation on components that require auditing. Which components those are is an organizational decision, supplied here through the asset inventory's logging_required flag. The platform cannot infer it.
What a check finds
Asset declared as requiring audit logging is producing no observed telemetry in the observation window.
Choose your platform
CISA performance goals
- 3.Q — Maintain log collection & storage
- 4.B — Identify adverse events
What a result does not prove
Absence of telemetry may reflect an inventory error, a routing change, or a genuinely idle asset rather than disabled logging. This check identifies where audit coverage cannot be evidenced — not where it definitively fails.