OpenControls Logo

STIG Viewer

STIGViewer Support

The Central Log Server system backups must be retained for a minimum of 5 years for SAMI (Sources and Methods Information) and a minimum of 7 days for non-SAMI on media capable of guaranteeing file integrity for the minimum applicable information retention period.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-206459SRG-APP-000125-AU-000310SV-206459r960948_ruleCCI-000167low
Description
If backups are not properly processed, protected, and stored on appropriate media, recovery from a system failure or implementation of a contingency plan would not include the data necessary to fully recover in the time required to ensure continued mission support.
STIGDate
Central Log Server Security Requirements Guide2024-12-04

Related Frameworks

2 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-01Continuous Monitoring
1.00
MON-01.4System Generated Alerts
1.00
MON-03Content of Event Logs
1.00
MON-10Event Log Retention
1.00
MON-08.1Event Log Backup on Separate Physical Systems / Components
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (21) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AU-10Non-repudiation
1.00
AU-11Audit Record Retention
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00
AU-12(3)Changes by Authorized Individuals
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00

+11 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.1
1.00
3.3.2
1.00
CCI2 mappings
CCI-000167
1.00
CCI-001348
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.PS-04
1.00

Who does this work

6 NICE work roles and 5 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-206459r960948_chk)

Review the SSP, backup media documentation, and system backup configuration. Verify the Central Log Server system is backed up to media capable of guaranteeing file integrity for a minimum of five years. If the Central Log Server does not retain backups for a minimum of five years for SAMI and a minimum of seven days for non-SAMI, this is a finding. If the Central Log Server system backups are not stored on appropriate media capable of guaranteeing file integrity for a minimum of five years for systems retaining SAMI, this is a finding.

Fix Text (F-6719r864171_fix)

Configure the Central Log Server to retain backups of system information for a minimum of five years for SAMI and a minimum of seven days for non-SAMI. Select backup media that guarantees file integrity for a minimum of five years for systems retaining SAMI. Document the required retention period in the SSP.