NIST 800-53 r5 · Controls catalogue · Family AU
AU-2Event Logging
Identify the types of events that the system is capable of logging in support of the audit function: {{ insert: param, au-02_odp.01 }}; Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; Specify the following event types for logging within the system: {{ insert: param, au-2_prm_2 }}; Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and Review and update the event types selected for logging {{ insert: param, au-02_odp.04 }}.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (6)
- aws-config-cloudtrail-enabled CloudTrail is enabled in the account AWS::CloudTrail::Trail partial
- aws-config-vpc-flow-logs-enabled VPC flow logs are enabled AWS::EC2::VPC partial
- azure-mcsb-lt-04-resource-logs Resource logs are streamed to Log Analytics or storage Microsoft.Insights/diagnosticSettings partial
- azure-mcsb-network-flow-logs NSG flow logs are enabled Microsoft.Network/networkSecurityGroups partial
- gcp-cis-vpc-flow-logs-enabled VPC subnetworks have flow logs enabled compute.googleapis.com/Subnetwork partial
- gcp-cis-cloud-audit-logs-enabled Cloud Audit Logs cover all admin/data services cloudresourcemanager.googleapis.com/Project partial
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (1)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-778 | Insufficient Logging | 23 | This control requires identifying, specifying, and justifying event types for logging with a focus on adequacy for post-incident investigations, directly mitigating insufficient logging. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-2240 | 1.5 | 7.2 | 0.0102 | good |
CVE-2025-52644 | 1.2 | 5.8 | 0.0004 | good |
CVE-2025-58587 | 1.3 | 6.5 | 0.0026 | partial |