AU-12 · Audit and Accountability · NIST SP 800-53 Rev5
AU-12: Audit records are generated for all defined auditable events by system components
How NIST SP 800-53 Rev5 control AU-12 (Audit and Accountability) maps to FedRAMP 20x Key Security Indicators, and the evidence scm.cc collects for it.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
What AU-12 requires
Audit records are generated for all defined auditable events by system components.
Paraphrased from NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations (checked 2026-10-31). scm.cc does not reproduce the official control text; read the NIST catalog for the normative wording.
FedRAMP 20x KSIs that cover AU-12
These Key Security Indicators officially cite AU-12 as a related SP 800-53 control, so satisfying them is how a 20x package demonstrates this control.
KSI-IAM-ELP — Ensuring Least Privilege
Identity and Access Management · official related-control citation: au-12.3
KSI-IAM-JIT — Authorizing Just-in-Time
Identity and Access Management · official related-control citation: au-12.3
KSI-MLA-ALA — Authorizing Log Access
Monitoring, Logging, and Auditing · official related-control citation: au-12.3
KSI-MLA-LET — Logging Event Types
Monitoring, Logging, and Auditing · official related-control citation: au-12
KSI-MLA-OSM — Operating SIEM Capability
Monitoring, Logging, and Auditing · official related-control citation: au-12.1
Evidence scm.cc collects for AU-12
scm.cc can collect this evidence automatically from a connected live system route and replay it, so a reviewer can re-run the check rather than trust a screenshot.