proc9000-1407-SOP.doc

SBA Procedural Notice

This is a reminder to personnel responsible for implementing audit logs and audit trails on SBA’s General Support Systems (GSS) and Major Applications (MA). Audit logs and audit trails are required on all SBA systems. They are the technical mechanisms which assist SBA managers in System Security and Audits in maintaining all user accountability. All managers can help promote proper user behavior by advising users that they are personally accountable for their actions, which can be tracked by an audit trail that logs their activities. Users are less likely to attempt to circumvent the Agency’s security policy if they know that their actions are being recorded in an audit log.

The audit logs and trails on SBA systems must work in concert with logical access controls, to identify and provide information about users activities, including improper modification of data (e.g., introducing errors into a database). The audit log or audit trail must record “before” and “after” versions of records. Then comparisons can be made between the actual changes made to records and what was expected. This will help managers to determine if errors were made by the user, by the system/application software, or by some other source.

If you require additional information about this Notice, please contact Lewis Baskerville on (202) 401-1980 or Joyce Lewis on (202) 205-6318.

Lawrence E. Barrett

Chief Information Office

EXPIRES: 1-1-2004

SBA Form 1353.3 (12-93) PerForm Version; previous editions obsolete.

Must be accompanied by SBA Form 58.