Rule ID
SV-207419r958606_rule
Version
V2R3
CCIs
If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.
Verify the VMM initiates session audits at system startup. If it does not, this is a finding.
Configure the VMM to initiate session audits at system startup.