NIST SP 800-53
Technical

Audit & Accountability Policy (AU Family) Template

Defines audit logging, monitoring, and accountability requirements aligned with NIST SP 800-53 AU control family.

What This Policy Covers

Purpose and Scope-Policy objectives and applicability (AU-1).
Auditable Events-Events that must be logged across all systems (AU-2).
Audit Record Content-Required fields: who, what, when, where, outcome (AU-3).
Audit Storage and Retention-Storage capacity, retention periods, and protection (AU-4, AU-9).
Audit Review and Analysis-Log review procedures and automated analysis (AU-6, AU-7).
Audit Reporting-Reporting cadence and escalation of findings (AU-6).
Time Synchronization-NTP requirements and timestamp accuracy (AU-8).
Non-Repudiation-Ensuring actions cannot be denied (AU-10).

Required Sections

A compliant Audit & Accountability Policy (AU Family) for NIST SP 800-53 must include the following8 sections. Each section addresses a specific control requirement that auditors will review.

1

Purpose and Scope

Policy objectives and applicability (AU-1).

2

Auditable Events

Events that must be logged across all systems (AU-2).

3

Audit Record Content

Required fields: who, what, when, where, outcome (AU-3).

4

Audit Storage and Retention

Storage capacity, retention periods, and protection (AU-4, AU-9).

5

Audit Review and Analysis

Log review procedures and automated analysis (AU-6, AU-7).

6

Audit Reporting

Reporting cadence and escalation of findings (AU-6).

7

Time Synchronization

NTP requirements and timestamp accuracy (AU-8).

8

Non-Repudiation

Ensuring actions cannot be denied (AU-10).

Generate a Customized Version

This template shows the required structure. PoliWriter generates a fully customized Audit & Accountability Policy (AU Family) that references your actual cloud providers, identity systems, tools, and team practices — ready for auditor review.

Policy Details

Category

Technical

Sections

8 total (8 required)

Other NIST SP 800-53 Templates

Access Control Policy (AC Family)

Establishes access control requirements covering account management, access enforcement, separation of duties, and least privilege, aligned with NIST SP 800-53 AC control family.

Security Assessment & Authorization Policy (CA Family)

Establishes requirements for security assessments, system authorization, and continuous monitoring, aligned with NIST SP 800-53 CA control family.

Configuration Management Policy (CM Family)

Defines configuration management requirements including baseline configurations, change control, and configuration monitoring, aligned with NIST SP 800-53 CM control family.

Contingency Planning Policy (CP Family)

Establishes contingency planning requirements including backup, recovery, and continuity of operations, aligned with NIST SP 800-53 CP control family.

Identification & Authentication Policy (IA Family)

Defines requirements for identifying and authenticating users, devices, and services, aligned with NIST SP 800-53 IA control family.

Incident Response Policy (IR Family)

Establishes an incident response capability including preparation, detection, analysis, containment, recovery, and post-incident activities, aligned with NIST SP 800-53 IR control family.

System & Communications Protection Policy (SC Family)

Defines requirements for protecting system communications and data, including boundary protection, cryptography, and denial-of-service protection, aligned with NIST SP 800-53 SC control family.

Risk Assessment Policy (RA Family)

Establishes requirements for assessing security risks including vulnerability scanning, threat analysis, and privacy impact assessments, aligned with NIST SP 800-53 RA control family.

View all 10 templates