STIGhub
STIGs
RMF Controls
Compare
← AU-9 — Protection of Audit Information
CCI-001495
Definition
Protect audit tools from unauthorized deletion.
Parent Control
AU-9
Protection of Audit Information
Audit and Accountability
Linked STIG Checks (144)
V-279037
CAT III
The ColdFusion file ownership and permissions must be restricted to prevent unauthorized access to log tools.
Adobe ColdFusion Security Technical Implementation Guide
V-274026
CAT II
Amazon Linux 2023 must use cryptographic mechanisms to protect the integrity of audit tools.
Amazon Linux 2023 Security Technical Implementation Guide
V-222948
CAT II
$CATALINA_HOME/bin folder permissions must be set to 750.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252534
CAT II
The macOS system must enable System Integrity Protection.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257240
CAT I
The macOS system must enable System Integrity Protection.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268432
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268433
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268454
CAT II
The macOS system must enable security auditing.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268456
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268457
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268458
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268459
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268460
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268461
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268462
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268463
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268464
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268465
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268473
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268474
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268475
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-268555
CAT I
The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-269095
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277040
CAT II
The macOS system must configure audit log files to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277041
CAT II
The macOS system must configure the audit log folder to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277062
CAT II
The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277063
CAT II
The macOS system must configure audit log files to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277064
CAT II
The macOS system must configure audit log folders to be owned by root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277065
CAT II
The macOS system must configure the audit log files group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277066
CAT II
The macOS system must configure the audit log folders group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277067
CAT II
The macOS system must configure audit log files to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277068
CAT II
The macOS system must configure audit log folders to mode 700 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277069
CAT II
The macOS system must be configured to audit all deletions of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277070
CAT II
The macOS system must be configured to audit all changes of object attributes.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277071
CAT II
The macOS system must be configured to audit all failed read actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277072
CAT II
The macOS system must be configured to audit all failed write actions on the system.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277080
CAT II
The macOS system must configure audit_control group to wheel.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277081
CAT II
The macOS system must configure audit_control owner to root.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277082
CAT II
The macOS system must configure audit_control owner to mode 440 or less permissive.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277083
CAT II
The macOS system must configure audit_control to not contain access control lists (ACLs).
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-277165
CAT I
The macOS system must ensure System Integrity Protection (SIP) is enabled.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204941
CAT II
The ALG must protect audit tools from unauthorized deletion.
Application Layer Gateway Security Requirements Guide
V-222505
CAT II
The application must protect audit tools from unauthorized deletion.
Application Security and Development Security Technical Implementation Guide
V-204737
CAT II
The application server must protect log tools from unauthorized deletion.
Application Server Security Requirements Guide
V-276014
CAT I
Ax-OS must off-load audit records onto a different system or media than the system being audited.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-219195
CAT II
The Ubuntu operating system must configure audit tools with a mode of 0755 or less permissive.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238344
CAT II
The Ubuntu operating system must have directories that contain system commands set to a mode of 0755 or less permissive.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238345
CAT II
The Ubuntu operating system must have directories that contain system commands owned by root.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-238346
CAT II
The Ubuntu operating system must have directories that contain system commands group-owned by root.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260485
CAT II
Ubuntu 22.04 LTS must have directories that contain system commands set to a mode of "755" or less permissive.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260493
CAT II
Ubuntu 22.04 LTS must have directories that contain system commands owned by "root".
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260494
CAT II
Ubuntu 22.04 LTS must have directories that contain system commands group-owned by "root".
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270824
CAT II
Ubuntu 24.04 LTS must have directories that contain system commands set to a mode of "0755" or less permissive.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270825
CAT II
Ubuntu 24.04 LTS must have directories that contain system commands owned by root.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270826
CAT II
Ubuntu 24.04 LTS must have directories that contain system commands group-owned by root.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221919
CAT II
The Central Log Server must protect audit tools from unauthorized deletion.
Central Log Server Security Requirements Guide
V-269542
CAT II
AlmaLinux OS 9 audit tools must be owned by root.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269543
CAT II
AlmaLinux OS 9 audit tools must have a mode of 0755 or less permissive.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233061
CAT II
The container platform must protect audit tools from unauthorized deletion.
Container Platform Security Requirements Guide
V-233609
CAT II
PostgreSQL must protect its audit features from unauthorized removal.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261880
CAT II
PostgreSQL must protect its audit features from unauthorized removal.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206543
CAT II
The DBMS must protect its audit features from unauthorized removal.
Database Security Requirements Guide
V-224153
CAT II
The EDB Postgres Advanced Server must protect its audit features from unauthorized removal.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213584
CAT II
The EDB Postgres Advanced Server must protect its audit features from unauthorized removal.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259233
CAT II
The EDB Postgres Advanced Server must protect its audit features from unauthorized removal.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-215754
CAT II
The BIG-IP Core implementation must be configured to protect audit tools from unauthorized deletion.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-278388
CAT II
NGINX must protect audit information from unauthorized access.
F5 NGINX Security Technical Implementation Guide
V-203674
CAT II
The operating system must protect audit tools from unauthorized deletion.
General Purpose Operating System Security Requirements Guide
V-268256
CAT II
The HYCU virtual appliance must protect audit tools from unauthorized access, modification, and deletion.
HYCU Protege Security Technical Implementation Guide
V-215248
CAT II
AIX audit tools must be owned by root.
IBM AIX 7.x Security Technical Implementation Guide
V-215249
CAT II
AIX audit tools must be group-owned by audit.
IBM AIX 7.x Security Technical Implementation Guide
V-215250
CAT II
AIX audit tools must be set to 4550 or less permissive.
IBM AIX 7.x Security Technical Implementation Guide
V-252574
CAT II
The IBM Aspera Console feature audit tools must be protected from unauthorized modification or deletion.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-213687
CAT II
DB2 must protect its audit features from unauthorized removal.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-65081
CAT II
The DataPower Gateway must protect audit tools from unauthorized deletion.
IBM DataPower Network Device Management Security Technical Implementation Guide
V-255853
CAT II
The WebSphere Application Server wsadmin file must be protected from unauthorized deletion.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-223554
CAT II
IBM z/OS SMF collection files (i.e., SYS1.MANx) access must be limited to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223701
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS RACF Security Technical Implementation Guide
V-223881
CAT II
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
IBM z/OS TSS Security Technical Implementation Guide
V-237932
CAT II
The IBM z/VM AUDT and Journal Mini Disks must be restricted to the appropriate system administrators.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-258600
CAT I
The ICS must be configured to prevent nonprivileged users from executing privileged functions.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-213825
CAT II
SQL Server and the operating system must protect SQL Server audit features from unauthorized removal.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-205482
CAT II
The Mainframe Product must protect audit tools from unauthorized deletion.
Mainframe Product Security Requirements Guide
V-253684
CAT II
MariaDB must protect its audit features from unauthorized removal.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220354
CAT II
MarkLogic Server must protect its audit features from unauthorized removal.
MarkLogic Server v9 Security Technical Implementation Guide
V-255332
CAT II
The audit information produced by Azure SQL Database must be protected from unauthorized deletion.
Microsoft Azure SQL Database Security Technical Implementation Guide
V-276299
CAT II
Azure SQL Managed Instance must protect its audit configuration from unauthorized access, modification, and deletion.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-271283
CAT II
SQL Server must protect its audit configuration from authorized and unauthorized access and modification.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-224880
CAT II
Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205731
CAT II
Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254299
CAT II
Windows Server 2022 Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278046
CAT II
Windows Server 2025 Event Viewer must be protected from unauthorized modification and deletion.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-221162
CAT II
MongoDB must protect its audit features from unauthorized access.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252136
CAT II
MongoDB must protect its audit features from unauthorized access.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265909
CAT II
MongoDB must protect its audit features from unauthorized access.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279337
CAT II
MongoDB must protect its audit features from unauthorized access, modification, and removal.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-202044
CAT II
The network device must protect audit tools from unauthorized deletion.
Network Device Management Security Requirements Guide
V-254186
CAT II
Nutanix AOS audit tools must be group-owned by root.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-279576
CAT II
Nutanix OS must configure the audit log files to be owned by root.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-219766
CAT II
The DBMS must protect audit tools from unauthorized deletion.
Oracle Database 11.2g Security Technical Implementation Guide
V-220282
CAT II
The system must protect audit tools from unauthorized deletion.
Oracle Database 12c Security Technical Implementation Guide
V-270511
CAT II
The system must protect audit tools from unauthorized access, modification, or deletion.
Oracle Database 19c Security Technical Implementation Guide
V-248808
CAT II
OL 8 audit tools must be owned by root.
Oracle Linux 8 Security Technical Implementation Guide
V-248809
CAT II
OL 8 audit tools must be group-owned by root.
Oracle Linux 8 Security Technical Implementation Guide
V-271569
CAT II
OL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
Oracle Linux 9 Security Technical Implementation Guide
V-235162
CAT II
The MySQL Database Server 8.0 must protect its audit features from unauthorized removal.
Oracle MySQL 8.0 Security Technical Implementation Guide
V-235959
CAT II
Oracle WebLogic must protect audit tools from unauthorized deletion.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-214143
CAT II
PostgreSQL must protect its audit features from unauthorized removal.
PostgreSQL 9.x Security Technical Implementation Guide
V-252843
CAT I
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-281077
CAT II
RHEL 10 must be configured so that audit tools are owned by "root".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281078
CAT II
RHEL 10 must be configured so that audit tools are group-owned by "root".
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-281094
CAT II
RHEL 10 must enforce a mode of "0755" or less permissive for audit tools.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-258137
CAT II
RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257535
CAT II
OpenShift must protect audit tools from unauthorized access.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-251207
CAT II
Redis Enterprise DBMS must protect its audit features from unauthorized removal.
Redis Enterprise 6.x Security Technical Implementation Guide
V-275579
CAT II
Ubuntu OS must have directories that contain system commands set to a mode of "755" or less permissive.
Riverbed NetIM OS Security Technical Implementation Guide
V-275587
CAT II
Ubuntu OS must have directories that contain system commands owned by "root".
Riverbed NetIM OS Security Technical Implementation Guide
V-275588
CAT II
Ubuntu OS must have directories that contain system commands group-owned by "root".
Riverbed NetIM OS Security Technical Implementation Guide
V-256079
CAT I
The Riverbed NetProfiler must be configured to authenticate each administrator prior to authorizing privileges based on roles.
Riverbed NetProfiler Security Technical Implementation Guide
V-261419
CAT II
SLEM 5 audit tools must have the proper permissions configured to protect against unauthorized access.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217203
CAT II
The SUSE operating system audit tools must have the proper permissions configured to protect against unauthorized access.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-216284
CAT II
The operating system must protect audit tools from unauthorized deletion.
Solaris 11 SPARC Security Technical Implementation Guide
V-216049
CAT II
The operating system must protect audit tools from unauthorized deletion.
Solaris 11 X86 Security Technical Implementation Guide
V-221935
CAT II
Splunk Enterprise installation directories must be secured.
Splunk Enterprise 7.x for Windows Security Technical Implementation Guide
V-251672
CAT II
Splunk Enterprise installation directories must be secured.
Splunk Enterprise 8.x for Linux Security Technical Implementation Guide
V-279251
CAT I
The Edge SWG must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-241025
CAT II
The Tanium Server must protect audit tools from unauthorized access, modification, or deletion.
Tanium 7.0 Security Technical Implementation Guide
V-234069
CAT II
The Tanium application must prohibit user installation of software without explicit privileged status.
Tanium 7.3 Security Technical Implementation Guide
V-254902
CAT II
The Tanium application must prohibit user installation, modification, or deletion of software without explicit privileged status.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-253831
CAT II
The Tanium application must prohibit user installation, modification, or deletion of software without explicit privileged status.
Tanium 7.x Security Technical Implementation Guide
V-241129
CAT II
Trend Deep Security must protect audit tools from unauthorized deletion.
Trend Micro Deep Security 9.x Security Technical Implementation Guide
V-253022
CAT II
TOSS audit tools must be owned by "root".
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282534
CAT II
TOSS 5 must use cryptographic mechanisms to protect the integrity of audit tools.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-240293
CAT II
The vRA PostgreSQL configuration files must have the correct group-ownership.
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
V-239790
CAT II
The vROps PostgreSQL DB must protect its audit features from unauthorized removal.
VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide
V-240491
CAT II
The SLES for vRealize must protect audit tools from unauthorized deletion.
VMware vRealize Automation 7.x SLES Security Technical Implementation Guide
V-239584
CAT II
The SLES for vRealize must protect audit tools from unauthorized deletion.
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide
V-256523
CAT II
The Photon operating system must protect audit tools from unauthorized modification and deletion.
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide
V-256593
CAT II
VMware Postgres configuration files must not be accessible by unauthorized users.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-258740
CAT II
The ESXi host must implement Secure Boot enforcement.
VMware vSphere 8.0 ESXi Security Technical Implementation Guide
V-258837
CAT II
The Photon operating system must protect audit tools from unauthorized access.
VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide
V-259168
CAT II
The vCenter PostgreSQL service configuration files must not be accessible by unauthorized users.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-207423
CAT II
The VMM must protect audit tools from unauthorized deletion.
Virtual Machine Manager Security Requirements Guide
V-269576
CAT II
Xylok Security Suite must protect audit information from any type of unauthorized access.
Xylok Security Suite 20.x Security Technical Implementation Guide