<commit_before>---
documentation_complete: false
name: Audit and Accountability
schema_version: 3.0.0
satisfies:

- control_key: AU-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '//*
        The customer will be responsible for developing, documenting, and
        disseminating Audit and Accountability policy and procedures. A
        successful control repsonse will need to address the content of the
        policy (which must include purpose, scope, roles, responsibilities,
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implementation of the policies and
        associated controls).
        */'
    - key: b
      text: |
        '//*
        The customer will be responsible for reviewing and updating the
        Audit and Accountability policy every 3 years, and procedures annually.
        A successful control response will need to address the review and update
        process, including the role(s) responsible for initiating the review
        process, updating the policy and procedures, and providing approval
        of the updates.
        */'

- control_key: AU-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '//*
        The customer will be responsible for determining which events their
        software applications must be capable of auditing. A successful control
        response will need to address the FedRAMP-required auditable events
        listed above as well as any additional events the customer feels should
        auditable based on customer needs.>

        <OpenShift, when deployed on Red Hat Enterprise Linux, utilizes the
        underlying audit subsystem. When the audit subsystem is enabled, the
        metadata required by this control is generated.
        */'
    - key: b
      text: |
        '//*
        The customer will be responsible for implementing this control. A
        successful control response will need to address coordination with all
        interested parties (such as an internal SOC or security team) and
        incorporation of their input into business requirements in order to
        determine the selection of auditable events.
        */'
    - key: c
      text: |
        '//*
        The customer will be responsible for implimenting this control. A
        successful control response will include a discussion of the decision
        process behind the selection of auditable events and a justification for
        the selected events being sufficient to support after-the-fact
        investigation.
        */'
    - key: d
      text: |
        '//*
        The customer will be responsible for selecting a subsec of the events
        listed in Part A to be audited by the system. For FedRAMP compliance,
        these events must be monitored continuously. A successful control
        response will include a discussion of the rationale for the events
        chosen.>

        <Details on configuring the OpenShift audit subsystem can be found
        here:

        https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/
        html/Security_Guide/sec-configuring_the_audit_service.html
        */'

- control_key: AU-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '//*
        Customers are responsible for reviewing and updating the audited
        events annually or whenever there is a change in the threat environment.
        A successful control response will outline how often events are
        reviewed.
        */'

- control_key: AU-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '//*
        Customers are responsiblef or generating audit records that contain
        information that establishes what type of event occured, when the event
        occurred, where the event occured, the source of the event, the
        outcome of the event, and the identity of any individuals or subjects
        associated with the event. A successful control response will outline
        what customers require their audit records to contain.
        */'

- control_key: AU-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none<commit_msg>Fixing typo<commit_after>---
documentation_complete: false
name: Audit and Accountability
schema_version: 3.0.0
satisfies:

- control_key: AU-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '//*
        The customer will be responsible for developing, documenting, and
        disseminating Audit and Accountability policy and procedures. A
        successful control repsonse will need to address the content of the
        policy (which must include purpose, scope, roles, responsibilities,
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implementation of the policies and
        associated controls).
        */'
    - key: b
      text: |
        '//*
        The customer will be responsible for reviewing and updating the
        Audit and Accountability policy every 3 years, and procedures annually.
        A successful control response will need to address the review and update
        process, including the role(s) responsible for initiating the review
        process, updating the policy and procedures, and providing approval
        of the updates.
        */'

- control_key: AU-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '//*
        The customer will be responsible for determining which events their
        software applications must be capable of auditing. A successful control
        response will need to address the FedRAMP-required auditable events
        listed above as well as any additional events the customer feels should
        auditable based on customer needs.>

        <OpenShift, when deployed on Red Hat Enterprise Linux, utilizes the
        underlying audit subsystem. When the audit subsystem is enabled, the
        metadata required by this control is generated.
        */'
    - key: b
      text: |
        '//*
        The customer will be responsible for implementing this control. A
        successful control response will need to address coordination with all
        interested parties (such as an internal SOC or security team) and
        incorporation of their input into business requirements in order to
        determine the selection of auditable events.
        */'
    - key: c
      text: |
        '//*
        The customer will be responsible for implimenting this control. A
        successful control response will include a discussion of the decision
        process behind the selection of auditable events and a justification for
        the selected events being sufficient to support after-the-fact
        investigation.
        */'
    - key: d
      text: |
        '//*
        The customer will be responsible for selecting a subsec of the events
        listed in Part A to be audited by the system. For FedRAMP compliance,
        these events must be monitored continuously. A successful control
        response will include a discussion of the rationale for the events
        chosen.>

        <Details on configuring the OpenShift audit subsystem can be found
        here:

        https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/
        html/Security_Guide/sec-configuring_the_audit_service.html
        */'

- control_key: AU-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '//*
        Customers are responsible for reviewing and updating the audited
        events annually or whenever there is a change in the threat environment.
        A successful control response will outline how often events are
        reviewed.
        */'

- control_key: AU-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '//*
        Customers are responsible for generating audit records that contain
        information that establishes what type of event occured, when the event
        occurred, where the event occured, the source of the event, the
        outcome of the event, and the identity of any individuals or subjects
        associated with the event. A successful control response will outline
        what customers require their audit records to contain.
        */'

- control_key: AU-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
{'fraction_non_alphanumeric': 0.051137643613426445, 'fraction_numerical': 0.008335210633025456, 'mean_word_length': 2.503946329913181, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6540483', 'n_tokens_mistral': 2193, 'n_tokens_neox': 2142, 'n_words': 980}