Information Systems Audit Policy

Information Systems Audit Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose

Safire, Inc. is committed to protecting the confidentiality, integrity, and availability of its information systems and the sensitive data they contain, specifically Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII).

This policy establishes the requirements for generating, protecting, and reviewing audit logs to detect, investigate, and recover from security incidents. It also establishes the authority for the Compliance and Security teams to conduct operational assessments to ensure these controls are effective.

Scope

This policy covers all computer and communication devices owned or operated by or on behalf of Safire. This includes workstations, servers, network devices, and security appliances that process, store, or transmit CUI.

Policy

Audit Authority and Access (Internal Assessment)

To facilitate security assessments, the Compliance Department, CISO, or designated representatives are granted:

• System & Network Access: Privileged access to monitor traffic, conduct vulnerability scans, and perform penetration testing.
• Physical Access: Access to data centers and secure areas to verify physical controls.
• Documentation Access: Authority to review all configurations and change records.
• No Expectation of Privacy: Users should have no expectation of privacy regarding activities performed on information systems.

Audit Logging and Accountability (Technical Controls)

To meet CMMC requirements, Safire Information Systems must:

• Event Generation: Enable logging on all in-scope systems to track user activities, exceptions, and security events (e.g., failed login attempts, privilege escalation, file access).
• Content of Logs: Audit records must include, at a minimum: what event occurred, when it occurred, where it occurred, the source of the event, and the outcome (success/failure).
• Time Synchronization: All systems must synchronize internal system clocks with an authoritative time source to ensure accurate timestamping of logs.
• Log Protection: Audit logs must be protected from unauthorized access, modification, and deletion.

Review and Retention

• Log Review: Designated security personnel must review audit logs at regular intervals (e.g., weekly) to identify suspicious activity.

• Retention: Audit logs must be retained for a minimum of one (1) year (or as defined by contract requirements) to support incident investigation.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

Failure to adhere to this policy compromises the security of Safire and its clients. An employee found to have violated this policy, or a System Owner found to be willfully neglecting logging configurations, may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Acceptable Use Policy
• Incident Response Plan

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Privileged Access

An authorized user who has access to system control, monitoring, or administration functions, such as a System Administrator.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page