IBM z/VM must have access to an audit reduction tool that allows for central data review and analysis.

Audit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit reduction and report generation capabilities do not always emanate from the same information system or from the same organizational entities conducting auditing activities. Audit reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. Audit records may at times be voluminous. Without a reduction tool crucial information may be overlooked.

Ask the system administrator if there is an audit reduction tool available for use with IBM z/VM.

Determine if a process is established to route audit records to the tool.

If there is no audit tool available, this is a finding.

If a procedure for routing audit records to the tool is not documented and on file with the ISSM/ISSO, this is a finding.

Develop a process for routing audit records to an audit reduction tool.

Document the process and file with the ISSM/ISSO.