NIST 800-53 r5 · Controls catalogue · Family AU
AU-12Audit Record Generation
Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on {{ insert: param, au-12_odp.01 }}; Allow {{ insert: param, au-12_odp.02 }} to select the event types that are to be logged by specific components of the system; and Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (5)
- aws-config-cloudtrail-enabled CloudTrail is enabled in the account AWS::CloudTrail::Trail partial
- aws-config-vpc-flow-logs-enabled VPC flow logs are enabled AWS::EC2::VPC partial
- azure-mcsb-lt-04-resource-logs Resource logs are streamed to Log Analytics or storage Microsoft.Insights/diagnosticSettings partial
- gcp-cis-vpc-flow-logs-enabled VPC subnetworks have flow logs enabled compute.googleapis.com/Subnetwork partial
- gcp-cis-cloud-audit-logs-enabled Cloud Audit Logs cover all admin/data services cloudresourcemanager.googleapis.com/Project mostly
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (1)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-778 | Insufficient Logging | 23 | Directly requires generation of audit records for specified events, preventing the absence of logging that allows undetected malicious activity. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-2240 | 1.5 | 7.2 | 0.0102 | good |
CVE-2025-52644 | 1.2 | 5.8 | 0.0004 | good |
CVE-2026-24058 | 2.0 | 9.8 | 0.0005 | good |
CVE-2026-30790 | 2.0 | 9.8 | 0.0015 | partial |
CVE-2026-30312 | 2.0 | 9.8 | 0.0085 | partial |
CVE-2025-57870 | 2.0 | 10.0 | 0.0017 | good |
CVE-2025-25595 | 2.0 | 9.8 | 0.0003 | partial |
CVE-2026-25560 | 2.0 | 9.8 | 0.0006 | partial |
CVE-2026-24436 | 2.0 | 9.8 | 0.0004 | partial |
CVE-2025-15030 | 2.0 | 9.8 | 0.0002 | partial |
CVE-2026-27593 | 1.9 | 9.3 | 0.0002 | partial |
CVE-2025-64175 | 1.8 | 8.8 | 0.0002 | partial |
CVE-2026-25538 | 1.8 | 8.8 | 0.0002 | good |
CVE-2025-55234 | 1.8 | 8.8 | 0.0033 | partial |
CVE-2026-40318 | 1.7 | 8.5 | 0.0007 | partial |
CVE-2026-4828 | 1.6 | 8.2 | 0.0005 | good |
CVE-2025-14037 | 1.6 | 8.1 | 0.0004 | partial |
CVE-2025-67507 | 1.6 | 8.1 | 0.0006 | partial |
CVE-2025-23368 | 1.6 | 8.1 | 0.0019 | partial |
CVE-2026-40600 | 1.6 | 8.1 | 0.0003 | partial |
CVE-2026-6832 | 1.6 | 8.1 | 0.0010 | partial |
CVE-2026-32729 | 1.6 | 8.1 | 0.0006 | partial |
CVE-2025-59893 | 1.6 | 8.0 | 0.0002 | partial |
CVE-2026-24669 | 1.6 | 7.8 | 0.0002 | partial |
CVE-2025-30076 | 1.5 | 7.7 | 0.0006 | partial |