NIST 800-53 Audit and Accountability Policy (AU)

Document ID: PLCY-NIST-AU-001
Version: 1.0
Effective Date: December 30, 2025
Last Review: December 30, 2025
Owner: Hop And Haul Team

---

CONFIDENTIAL

This document is CONFIDENTIAL and for internal use only. Do not distribute outside the organization.

1. Purpose

This document defines Hop And Haul' implementation of the NIST 800-53 Audit and Accountability (AU) family for FedRAMP Moderate authorization. It establishes requirements for audit logging, log protection, retention, and analysis to ensure accountability and support security investigations.

---

2. Scope

This policy applies to:

• All Hop And Haul system components generating audit events
• All user activities requiring accountability
• All security-relevant events
• All administrative and privileged operations

---

3. Audit Policy and Procedures (AU-1)

3.1 Policy Statement

Hop And Haul implements comprehensive audit logging that:

• Records all security-relevant events
• Protects audit records from unauthorized modification
• Retains logs for appropriate periods
• Enables investigation and forensic analysis

3.2 Responsibilities

Role	Responsibilities
Security Team	Define audit requirements, review logs, investigate incidents
System Administrators	Configure and maintain logging infrastructure
Development Team	Implement application-level logging
Compliance	Ensure retention compliance, support audits

3.3 Review Cadence

Activity	Frequency	Owner
Audit policy review	Annual	Security
Log configuration review	Quarterly	Operations
Audit log review	Weekly	Security
Privileged action review	Daily	Security

---

4. Event Logging (AU-2)

4.1 Auditable Events

The following events are logged for all system components:

Event Category	Events Logged	Priority
Authentication	Login success/failure, logout, MFA challenge, session creation	Critical
Authorization	Access granted/denied, permission changes, role changes	Critical
Account Management	Create, modify, disable, delete accounts	Critical
Data Access	Read, create, update, delete of sensitive data	High
Configuration Changes	System settings, security parameters	Critical
Administrative Actions	Break-glass access, privileged commands	Critical
Security Events	Failed attempts, anomalies, alerts triggered	Critical
Ride Operations	Offer, accept, start, complete, cancel	High
Safety Events	SOS trigger, deviation alert, mismatch report	Critical

4.2 Audit Event Selection

Criteria	Events Selected
Security impact	High or critical impact events
Accountability	User-initiated actions
Compliance	Regulatory required events
Forensics	Investigation support events

---

5. Content of Audit Records (AU-3)

5.1 Required Audit Fields

Field	Description	Example
Event ID	Unique identifier	evt_abc123
Timestamp	UTC ISO 8601	2025-12-30T14:30:00.000Z
Event Type	Category and action	auth.login.success
Actor ID	User or system identifier	usr_xyz789
Actor Type	User, system, or service	user
Organization ID	Tenant context	org_fleet123
Resource ID	Affected resource	ride_456
Resource Type	Type of resource	ride
Source IP	Request origin	192.168.1.100
User Agent	Client identifier	Hop And Haul-iOS/2.1.0
Result	Success or failure	success
Details	Additional context	{...}

5.2 Additional Information (AU-3(1))

For security-critical events, additional fields are captured:

Field	When Captured	Purpose
Session ID	All authenticated requests	Session correlation
Device Fingerprint	Mobile access	Device identification
Geographic Location	Location-sensitive operations	Anomaly detection
Previous Value	Configuration changes	Change tracking
New Value	Configuration changes	Change tracking
Approval ID	Approved actions	Approval chain

---

6. Audit Log Storage Capacity (AU-4)

6.1 Storage Requirements

Log Type	Volume Estimate	Storage Location
Application logs	50 GB/month	CloudWatch Logs
Security logs	20 GB/month	S3 (encrypted)
Access logs	30 GB/month	CloudWatch Logs
Audit trail	10 GB/month	Dedicated audit DB

6.2 Capacity Management

Metric	Threshold	Action
Storage utilization	70%	Alert + capacity review
Storage utilization	85%	Urgent expansion
Storage utilization	95%	Emergency response

6.3 Storage Capacity Warning (AU-4(1))

Automated alerts trigger when:

• Storage approaches 70% capacity
• Log ingestion rate exceeds baseline by 200%
• Storage costs exceed budget threshold

---

7. Response to Audit Logging Process Failures (AU-5)

7.1 Failure Response

Failure Type	Immediate Action	Escalation
Log service unavailable	Alert security team	Page on-call
Storage full	Emergency rotation	Expand storage
Log corruption detected	Isolate affected logs	Security investigation
Audit agent failure	Restart agent	Replace agent

7.2 Failure Notifications (AU-5(1))

Recipient	Notification Method	SLA
Security team	PagerDuty alert	Immediate
Operations team	Slack notification	5 minutes
Management	Email summary	1 hour

---

8. Audit Record Review, Analysis, and Reporting (AU-6)

8.1 Review Process

Review Type	Frequency	Scope	Owner
Automated analysis	Real-time	All security events	SIEM
Daily review	Daily	Privileged actions, failures	Security
Weekly review	Weekly	Trends, anomalies	Security
Compliance review	Monthly	Regulatory events	Compliance

8.2 Analysis Capabilities

Capability	Tool	Purpose
Real-time alerting	CloudWatch Alarms	Immediate threat detection
Pattern analysis	SIEM rules	Anomaly detection
Correlation	Log aggregation	Multi-event analysis
Forensic search	Elasticsearch	Investigation support

8.3 Automated Integration (AU-6(1))

Integration	Purpose	Status
SIEM correlation	Cross-system analysis	Implemented
Alert automation	Incident triggering	Implemented
Report generation	Compliance reporting	Implemented
Ticket creation	Incident tracking	Implemented

---

9. Audit Record Reduction and Report Generation (AU-7)

9.1 Query Capabilities

Capability	Description
Time range filtering	Select events within date range
User filtering	Events by specific user/role
Event type filtering	Events by category
Resource filtering	Events affecting specific resource
Full-text search	Search event details
Aggregation	Count, group, summarize events

9.2 Report Templates

Report	Content	Frequency
Security summary	Failed logins, alerts, incidents	Daily
Access report	User access patterns, anomalies	Weekly
Compliance report	Regulatory event summary	Monthly
Executive summary	Key metrics, trends	Monthly

---

10. Time Stamps (AU-8)

10.1 Time Synchronization

Requirement	Implementation
Time source	AWS NTP, synchronized to stratum 1
Accuracy	Within 1 second of authoritative source
Format	ISO 8601 UTC
Synchronization	All servers sync to same source

10.2 Timestamp Protection

Control	Implementation
Server-side only	Timestamps generated server-side
No client override	Client timestamps logged but not trusted
Audit of time changes	System time changes are logged

---

11. Protection of Audit Information (AU-9)

11.1 Log Protection Controls

Control	Implementation
Immutability	Append-only storage (S3 Object Lock)
Encryption at rest	AES-256 encryption
Encryption in transit	TLS 1.3
Access restriction	Security team only
Integrity verification	Cryptographic checksums

11.2 Access Restrictions (AU-9(4))

Access Level	Who	Capabilities
Read	Security analysts	Query, report generation
Read	Auditors	Time-limited read access
Write	System only	No human write access
Delete	No one	Immutable (lifecycle only)
Admin	Security lead	Configuration only

11.3 Integrity Protection

Mechanism	Purpose
SHA-256 checksums	Detect modification
Log signing	Prove authenticity
Chain verification	Detect deletion
Cross-region replication	Disaster recovery

---

12. Audit Record Retention (AU-11)

12.1 Retention Schedule

Log Type	Retention Period	Storage Tier	Rationale
Security events	24 months	Hot → Warm	FedRAMP requirement
Authentication logs	24 months	Hot → Warm	Compliance
Application logs	12 months	Hot → Cold	Operational
Safety incident logs	7 years	Warm → Cold	Legal/regulatory
Ride operational logs	36 months	Warm → Cold	PLCY-RET-001

12.2 Lifecycle Management

Age	Storage Tier	Cost	Access Speed
0-30 days	Hot (CloudWatch)	High	Instant
31-180 days	Warm (S3 Standard)	Medium	Fast
181+ days	Cold (S3 Glacier)	Low	Hours

12.3 Deletion Process

• Automated lifecycle policies delete expired logs
• Deletion events are logged
• Legal hold prevents deletion when active
• Cryptographic erasure for sensitive data

---

13. Audit Record Generation (AU-12)

13.1 Generation Points

Component	Logging Mechanism	Events Generated
API Gateway	Access logs	All API requests
Application	Structured logging	Business events
Database	Audit triggers	Data changes
Infrastructure	CloudTrail	AWS operations
Security tools	Native logging	Security events

13.2 Generation Assurance

Control	Implementation
Mandatory logging	Cannot disable without approval
Startup verification	Logging confirmed on component start
Health monitoring	Log agent health checks
Failure alerting	Immediate alert on logging failure

---

14. Hop And Haul-Specific Audit Requirements

14.1 Ride Lifecycle Events

Event	Fields	Retention
Ride offered	offer_id, driver_id, rider_id (hashed), timestamp	36 months
Ride accepted	ride_id, acceptance_time, verification_method	36 months
Ride started	ride_id, start_location (fuzzed), verification_result	36 months
Ride completed	ride_id, end_time, fare_amount	36 months
Ride cancelled	ride_id, cancel_reason, cancelled_by	36 months

14.2 Safety Event Logging

Event	Additional Data	Retention
SOS triggered	GPS snapshot, device state	7 years
Route deviation	planned vs actual route	7 years
Driver mismatch	reported details, photo evidence	7 years
Duress code entered	silent alert recipients	7 years

14.3 Admin Activity Logging

Activity	Logged Details
User data access	Query parameters, results count, justification
Break-glass access	Reason, approver, time-box
Configuration change	Before/after values, approver
Report generation	Parameters, record count

---

15. Related Documents

Document	Relationship
PLCY-AUD-001	Audit trail specifications
PLCY-RET-001	Retention requirements
PLCY-SEC-001	Security logging requirements
PLCY-FED-005	NIST control mapping

---

16. Document Control

Version	Date	Author	Changes
1.0	December 30, 2025	Hop And Haul Team	Initial release