STIGhub
STIGs
RMF Controls
Compare
← AU-9 — Protection of Audit Information
CCI-001494
Definition
Protect audit tools from unauthorized modification.
Parent Control
AU-9
Protection of Audit Information
Audit and Accountability
Linked STIG Checks (150)
V-279037
CAT III
The ColdFusion file ownership and permissions must be restricted to prevent unauthorized access to log tools.
Adobe ColdFusion Security Technical Implementation Guide
V-274026
CAT II
Amazon Linux 2023 must use cryptographic mechanisms to protect the integrity of audit tools.
Amazon Linux 2023 Security Technical Implementation Guide
V-222948
CAT II
$CATALINA_HOME/bin folder permissions must be set to 750.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252534
CAT II
The macOS system must enable System Integrity Protection.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257240
CAT I
The macOS system must enable System Integrity Protection.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268432
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268433
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268454
CAT II
The macOS system must enable security auditing.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268456
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268457
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268458
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268459
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268460
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268461
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268462
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268463
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268464
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268465
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268473
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268474
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268475
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268555
CAT I
The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-269095
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277040
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277041
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277062
CAT II
The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277063
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277064
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277065
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277066
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277067
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277068
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277069
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277070
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277071
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277072
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277080
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277081
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277082
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277083
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277165
CAT I
The macOS system must ensure System Integrity Protection (SIP) is enabled.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204940
CAT II
The ALG must protect audit tools from unauthorized modification.
Application Layer Gateway Security Requirements Guide
V-222504
CAT II
The application must protect audit tools from unauthorized modification.
Application Security and Development Security Technical Implementation Guide
V-204736
CAT II
The application server must protect log tools from unauthorized modification.
Application Server Security Requirements Guide
V-276014
CAT I
Ax-OS must off-load audit records onto a different system or media than the system being audited.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-219195
CAT II
The Ubuntu operating system must configure audit tools with a mode of 0755 or less permissive.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238300
CAT II
The Ubuntu operating system must configure audit tools with a mode of 0755 or less permissive.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238301
CAT II
The Ubuntu operating system must configure audit tools to be owned by root.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238302
CAT II
The Ubuntu operating system must configure the audit tools to be group-owned by root.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260492
CAT II
Ubuntu 22.04 LTS must configure audit tools with a mode of "755" or less permissive.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260507
CAT II
Ubuntu 22.04 LTS must configure audit tools to be owned by "root".
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270821
CAT II
Ubuntu 24.04 LTS must configure audit tools with a mode of "0755" or less permissive.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270822
CAT II
Ubuntu 24.04 LTS must configure audit tools to be owned by root.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270823
CAT II
Ubuntu 24.04 LTS must configure the audit tools to be group owned by root.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221918
CAT II
The Central Log Server must protect audit tools from unauthorized modification.
Central Log Server Security Requirements Guide
V-269545
CAT II
AlmaLinux OS 9 must use cryptographic mechanisms to protect the integrity of audit tools.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233060
CAT II
The container platform must protect audit tools from unauthorized modification.
Container Platform Security Requirements Guide
V-233618
CAT II
PostgreSQL must protect its audit configuration from unauthorized modification.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261879
CAT II
PostgreSQL must protect its audit configuration from unauthorized modification.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206542
CAT II
The DBMS must protect its audit configuration from unauthorized modification.
Database Security Requirements Guide
V-224152
CAT II
The EDB Postgres Advanced Server must protect its audit configuration from unauthorized modification.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213583
CAT II
The EDB Postgres Advanced Server must protect its audit configuration from unauthorized modification.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259232
CAT II
The EDB Postgres Advanced Server must protect its audit configuration from unauthorized modification.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-215753
CAT II
The BIG-IP Core implementation must be configured to protect audit tools from unauthorized modification.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-230216
CAT II
The BIG-IP Core implementation must be configured to activate a session lock to conceal information previously visible on the display for connections to virtual servers.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-278388
CAT II
NGINX must protect audit information from unauthorized access.
F5 NGINX Security Technical Implementation Guide
V-234187
CAT II
The FortiGate device must protect audit tools from unauthorized modification.
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide
V-203673
CAT II
The operating system must protect audit tools from unauthorized modification.
General Purpose Operating System Security Requirements Guide
V-268256
CAT II
The HYCU virtual appliance must protect audit tools from unauthorized access, modification, and deletion.
HYCU Protege Security Technical Implementation Guide
V-215248
CAT II
AIX audit tools must be owned by root.
IBM AIX 7.x Security Technical Implementation Guide
V-215249
CAT II
AIX audit tools must be group-owned by audit.
IBM AIX 7.x Security Technical Implementation Guide
V-215250
CAT II
AIX audit tools must be set to 4550 or less permissive.
IBM AIX 7.x Security Technical Implementation Guide
V-252574
CAT II
The IBM Aspera Console feature audit tools must be protected from unauthorized modification or deletion.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-213686
CAT II
DB2 must protect its audit configuration from unauthorized modification.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-65079
CAT II
The DataPower Gateway must protect audit tools from unauthorized modification.
IBM DataPower Network Device Management Security Technical Implementation Guide
V-255852
CAT II
The WebSphere Application Server wsadmin file must be protected from unauthorized modification.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223554
CAT II
IBM z/OS SMF collection files (i.e., SYS1.MANx) access must be limited to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223701
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS RACF Security Technical Implementation Guide
V-223881
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS TSS Security Technical Implementation Guide
V-237932
CAT II
The IBM z/VM AUDT and Journal Mini Disks must be restricted to the appropriate system administrators.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-213824
CAT II
SQL Server and/or the operating system must protect its audit configuration from unauthorized modification.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-213948
CAT II
SQL Server must protect its audit configuration from authorized and unauthorized access and modification.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205481
CAT II
The Mainframe Product must protect audit tools from unauthorized modification.
Mainframe Product Security Requirements Guide
V-253683
CAT II
MariaDB must protect its audit configuration from unauthorized modification.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220353
CAT II
MarkLogic Server must protect its audit configuration from unauthorized modification.
MarkLogic Server v9 Security Technical Implementation Guide
V-255332
CAT II
The audit information produced by Azure SQL Database must be protected from unauthorized deletion.
Microsoft Azure SQL Database Security Technical Implementation Guide
V-276299
CAT II
Azure SQL Managed Instance must protect its audit configuration from unauthorized access, modification, and deletion.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-271283
CAT II
SQL Server must protect its audit configuration from authorized and unauthorized access and modification.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-224880
CAT II
Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205731
CAT II
Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254299
CAT II
Windows Server 2022 Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278046
CAT II
Windows Server 2025 Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-221162
CAT II
MongoDB must protect its audit features from unauthorized access.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252136
CAT II
MongoDB must protect its audit features from unauthorized access.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265909
CAT II
MongoDB must protect its audit features from unauthorized access.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279337
CAT II
MongoDB must protect its audit features from unauthorized access, modification, and removal.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-202043
CAT II
The network device must protect audit tools from unauthorized modification.
Network Device Management Security Requirements Guide
V-254185
CAT II
Nutanix AOS audit tools must be owned by root.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279576
CAT II
Nutanix OS must configure the audit log files to be owned by root.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-219765
CAT II
The DBMS must protect audit tools from unauthorized modification.
Oracle Database 11.2g Security Technical Implementation Guide
V-220281
CAT II
The system must protect audit tools from unauthorized modification.
Oracle Database 12c Security Technical Implementation Guide
V-270511
CAT II
The system must protect audit tools from unauthorized access, modification, or deletion.
Oracle Database 19c Security Technical Implementation Guide
V-221652
CAT I
The Oracle Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.
Oracle Linux 7 Security Technical Implementation Guide
V-248808
CAT II
OL 8 audit tools must be owned by root.
Oracle Linux 8 Security Technical Implementation Guide
V-248809
CAT II
OL 8 audit tools must be group-owned by root.
Oracle Linux 8 Security Technical Implementation Guide
V-271569
CAT II
OL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
Oracle Linux 9 Security Technical Implementation Guide
V-235161
CAT II
The MySQL Database Server 8.0 must protect its audit configuration from unauthorized modification.
Oracle MySQL 8.0 Security Technical Implementation Guide
V-235958
CAT II
Oracle WebLogic must protect audit tools from unauthorized modification.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-214152
CAT II
PostgreSQL must protect its audit configuration from unauthorized modification.
PostgreSQL 9.x Security Technical Implementation Guide
V-252843
CAT I
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-281077
CAT II
RHEL 10 must be configured so that audit tools are owned by "root".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281078
CAT II
RHEL 10 must be configured so that audit tools are group-owned by "root".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281094
CAT II
RHEL 10 must enforce a mode of "0755" or less permissive for audit tools.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-204392
CAT I
The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-258137
CAT II
RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257535
CAT II
OpenShift must protect audit tools from unauthorized access.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-251206
CAT II
Redis Enterprise DBMS must protect its audit configuration from unauthorized modification.
Redis Enterprise 6.x Security Technical Implementation Guide
V-275586
CAT II
Ubuntu OS must configure audit tools with a mode of "755" or less permissive.
Riverbed NetIM OS Security Technical Implementation Guide
V-275601
CAT II
Ubuntu OS must configure audit tools to be owned by "root".
Riverbed NetIM OS Security Technical Implementation Guide
V-256079
CAT I
The Riverbed NetProfiler must be configured to authenticate each administrator prior to authorizing privileges based on roles.
Riverbed NetProfiler Security Technical Implementation Guide
V-261419
CAT II
SLEM 5 audit tools must have the proper permissions configured to protect against unauthorized access.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217203
CAT II
The SUSE operating system audit tools must have the proper permissions configured to protect against unauthorized access.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-216283
CAT II
The operating system must protect audit tools from unauthorized modification.
Solaris 11 SPARC Security Technical Implementation Guide
V-216048
CAT II
The operating system must protect audit tools from unauthorized modification.
Solaris 11 X86 Security Technical Implementation Guide
V-221935
CAT II
Splunk Enterprise installation directories must be secured.
Splunk Enterprise 7.x for Windows Security Technical Implementation Guide
V-251672
CAT II
Splunk Enterprise installation directories must be secured.
Splunk Enterprise 8.x for Linux Security Technical Implementation Guide
V-279251
CAT I
The Edge SWG must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-94675
CAT II
Symantec ProxySG must protect the Web Management Console, SSH, and command line interface (CLI) from unauthorized modification.
Symantec ProxySG NDM Security Technical Implementation Guide
V-241025
CAT II
The Tanium Server must protect audit tools from unauthorized access, modification, or deletion.
Tanium 7.0 Security Technical Implementation Guide
V-234069
CAT II
The Tanium application must prohibit user installation of software without explicit privileged status.
Tanium 7.3 Security Technical Implementation Guide
V-254902
CAT II
The Tanium application must prohibit user installation, modification, or deletion of software without explicit privileged status.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-253831
CAT II
The Tanium application must prohibit user installation, modification, or deletion of software without explicit privileged status.
Tanium 7.x Security Technical Implementation Guide
V-241128
CAT II
Trend Deep Security must protect audit tools from unauthorized modification.
Trend Micro Deep Security 9.x Security Technical Implementation Guide
V-253022
CAT II
TOSS audit tools must be owned by "root".
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282534
CAT II
TOSS 5 must use cryptographic mechanisms to protect the integrity of audit tools.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-240292
CAT II
The vRA PostgreSQL configuration files must have the correct ownership.
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
V-239789
CAT II
The vROps PostgreSQL DB must protect its audit configuration from unauthorized modification.
VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide
V-240490
CAT II
The SLES for vRealize must protect audit tools from unauthorized modification.
VMware vRealize Automation 7.x SLES Security Technical Implementation Guide
V-239583
CAT II
The SLES for vRealize must protect audit tools from unauthorized modification.
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide
V-256447
CAT II
The ESXi host must implement Secure Boot enforcement.
VMware vSphere 7.0 ESXi Security Technical Implementation Guide
V-256523
CAT II
The Photon operating system must protect audit tools from unauthorized modification and deletion.
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide
V-256593
CAT II
VMware Postgres configuration files must not be accessible by unauthorized users.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-258740
CAT II
The ESXi host must implement Secure Boot enforcement.
VMware vSphere 8.0 ESXi Security Technical Implementation Guide
V-258837
CAT II
The Photon operating system must protect audit tools from unauthorized access.
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide
V-259168
CAT II
The vCenter PostgreSQL service configuration files must not be accessible by unauthorized users.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-207422
CAT II
The VMM must protect audit tools from unauthorized modification.
Virtual Machine Manager Security Requirements Guide
V-73411
CAT II
Event Viewer must be protected from unauthorized modification and deletion.
Windows Server 2016 Security Technical Implementation Guide
V-73411
CAT II
Event Viewer must be protected from unauthorized modification and deletion.
Windows Server 2016 Security Technical Implementation Guide
V-93195
CAT II
Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion.
Windows Server 2019 Security Technical Implementation Guide
V-269576
CAT II
Xylok Security Suite must protect audit information from any type of unauthorized access.
Xylok Security Suite 20.x Security Technical Implementation Guide