The ALG must identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.

Without identifying the users who initiated the traffic, it would be difficult to identify those responsible for the denied communications. This requirement applies to those network elements that perform Data Leakage Prevention (DLP) (e.g., ALGs, proxies, or application level firewalls).

Verify the ALG identifies and logs internal users associated with denied outgoing communications traffic posing a threat to external information systems. If the ALG does not identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems, this is a finding.

Configure the ALG to identify and log internal users associated with denied outgoing communications traffic posing a threat to external information systems.