10.2.1.6 Audit logs capture all initialization, stopping, or pausing of the audit logs.

Defined Approach Requirements

10.2.1.6 Audit logs capture the following:

• All initialization of new audit logs, and
• All starting, stopping, or pausing of the existing audit logs.

Customized Approach Objective

Records of all changes to audit log activity status are captured.

Defined Approach Testing Procedures

10.2.1.6 Examine audit log configurations and log data to verify that all elements specified in this requirement are captured.

Purpose

Turning off or pausing audit logs before performing illicit activities is common practice for malicious users who want to avoid detection.

Initialization of audit logs could indicate that a user disabled the log function to hide their actions.