Cyber Posture

NIST 800-53 r5 · Controls catalogue · Family AU

AU-6Audit Record Review, Analysis, and Reporting

Review and analyze system audit records {{ insert: param, au-06_odp.01 }} for indications of {{ insert: param, au-06_odp.02 }} and the potential impact of the inappropriate or unusual activity; Report findings to {{ insert: param, au-06_odp.03 }} ; and Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Last updated: 09 May 2026 03:25 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (0)

Weaknesses this control addresses (7)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-200Exposure of Sensitive Information to an Unauthorized Actor10,204Audit record review and analysis can detect unauthorized exposure or access to sensitive information.
CWE-284Improper Access Control4,832System audit review detects violations of access controls by identifying unauthorized access attempts.
CWE-287Improper Authentication4,730Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.
CWE-400Uncontrolled Resource Consumption3,324Analysis identifies uncontrolled resource consumption indicative of denial-of-service or abuse attempts.
CWE-269Improper Privilege Management2,907Review helps detect improper privilege management by flagging unauthorized privilege changes or uses.
CWE-285Improper Authorization1,230Audit analysis reports findings of improper authorization, reducing the impact of such weaknesses.
CWE-250Execution with Unnecessary Privileges305Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2026-401931.68.20.0005partial
CVE-2026-42761.57.50.0007partial
CVE-2024-22401.57.20.0102good
CVE-2026-336651.57.50.0002partial

Other controls in family AU

AU-1 AU-10 AU-11 AU-12 AU-13 AU-14 AU-15 AU-16 AU-2 AU-3 AU-4 AU-5 AU-7 AU-8 AU-9