The operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-203702	SRG-OS-000343-GPOS-00134	SV-203702r971542_rule	CCI-001855	low
Description
If security personnel are not notified immediately when storage volume reaches 75% utilization, they are unable to plan for audit record storage capacity expansion.
STIG			Date
General Purpose Operating System Security Requirements Guide			2024-12-04

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-05.2Event Log Storage Capacity Alerting

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (11) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-12Audit Record Generation

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-3Content of Audit Records

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-3(1)Additional Audit Information

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-4Audit Log Storage Capacity

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-4(1)Transfer to Alternate Storage

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-5Response to Audit Logging Process Failures

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-5(1)Storage Capacity Warning

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-5(2)Real-time Alerts

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)9our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)9intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-7Audit Record Reduction and Report Generation

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-9(3)Cryptographic Protection

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+1 more (top 10 by confidence shown)

CCI1 mapping

CCI-001855

1.00

DISA STIG Benchmark (XCCDF)3intersects(normalised)

Details

Check Text (C-203702r971542_chk)

Verify the operating system immediately notifies the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity. If it does not, this is a finding.

Fix Text (F-3827r375054_fix)

Configure the operating system to immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity.