ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS05.0270 Synch\Maint Audit Data Backup
STIG ID \ V-Key DS05.0270 \ V0011765
Severity Cat III
Short Name Synch\Maint Audit Data Backup
IA Controls ECTB-1
MAC /Conf 1-CSP, 2-CSP, 3-C
References AD STIG 2.3.3.5
Long Name: Audit data from a synch\maint implementation is not backed up at least weekly on
external media or on a system other than where the implementation executes.
Checks:
Note: This check is Not Applicable if the audit data is collected in a Windows Event
Log. [Windows Event Log backup is reviewed in the Windows Checklist.]
• Interview the Application SA.
• Obtain a copy of the site’s policy that addresses (audit) data backup.
• Check that the policy addresses the requirement for the audit data from a
synch\maint implementation to be:
- Backed up at least weekly
- Backed up on external media or to a system other than the one on which the
implementation runs.
Alternatively review logs or other evidence that indicates audit data backup
frequency and output destination.
• If the audit data is not backed up at least weekly or is not backed up to a detached
location, then this is a Finding.
UNCLASSIFIED
3-17