V-222453
Application Security and Development Security Technical Implementation Guide
Title
The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.
Description
<VulnDiscussion>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Categories of information is information that is identified as being sensitive or requiring additional protection from regular user access. The data is accessed on a need to know basis and has been assigned a category or a classification i...
Fix Text (Documentation Requirement)
Configure the application to create an audit record for both successful and unsuccessful attempts to access protected categories of information.