Verify there is a script that off-loads audit data and the script runs weekly by using the following command: Note: If the system is not connected to a network, this requirement is not applicable. $ ls /etc/cron.weekly <audit_offload_script_name> Check if the script inside the file off-loads audit logs to external media. If the script file does not exist or does not off-load audit logs, this is a finding.