Definitions
Business Owner
A designated organizational official who "owns" the purpose of the information system and is ultimately accountable for the business function performed by that system and for accepting the risks associated with its operation.
Audit Log
A chronological record of system activities that is sufficient to enable the monitoring, analysis, investigation, and reporting of unauthorized or inappropriate information system activity.
Audit Record
An audit record is an individual entry within an audit log containing information that establishes the details about a single, time-stamped system event to support monitoring, investigation, and accountability.
Accountable Entity
An accountable entity is any organization that owns, operates, or manages information systems or services subject to these cybersecurity directives. For GNB, the Accountable Entity is the OCIO. Any other organization that is a participant in the GNB WAN, as formalized by a Network Access Agreement or other contractual agreement, is also an Accountable Entity.
Directive (AU-1: Audit and Accountability)
GNB shall establish, implement, and maintain a formal Audit and Accountability Directive to ensure that information system activity is recorded, reviewed, protected, and used to support security, operational integrity, and regulatory compliance. This Directive defines the purpose, scope, roles, responsibilities, and compliance expectations for the auditing and monitoring of organizational systems and data.
Purpose
This directive establishes the foundation for auditing and accountability practices that support incident detection, forensic analysis, policy compliance, and risk management across the organization. These requirements to ensure transparency, traceability, and effective oversight of information system activity.
The objective of the Audit and Accountability Directive is to describe the requirements for:
- the creation and storage of audit records for information systems, system components, or system services, to enable effective monitoring and reporting
- the monitoring and validation of information systems, to ensure compliance with GNB directives
