HITSP Security Audit Service Collaboration

The HITSP Security Audit Service Collaboration describes the mechanism to record security relevant events in support of policy, regulation, or risk analysis. It also provides the mechanism to determine the record format to support analytical reports that are needed. This Service Collaboration utilizes the following constructs:

For more information about the underlying capabilities, pre-conditions, post-conditions, data flows and other detailed information, please refer to the constructs that are used by this Service Collaboration.

This Service Collaboration document illustrates one internal view diagram and sequence table for each service interface. The diagrams are descriptive and the sequences are not mandatory. They may be affected by policy, chosen architecture, and implementation details. Conformance is measured against the underlying constructs.

1.2 Service Collaboration Invocation

Service Collaboration	Service Collaboration Description	Interface	Interface Optionality [1]
HITSP/SC109	Provides the mechanism to record security audit events	Send Security Audit Event	R

1.3 External View ( i.e.,black box diagram)

There is one example diagram included for each service interface. The diagrams are descriptive and the sequences are not mandatory. They may be affected by policy, chosen architecture, and implementation details. Conformance is measured against the underlying constructs.

1.3.1 Service Collaboration Source Constructs

Construct	Description
HITSP/T15 - Collect and Communicate Security Audit Trail	The Collect and Communicate Security Audit Trail Transaction is a means to provide assurance that security policies are being followed or enforced and that risks are being mitigated. This document describes the mechanisms to define and identify security relevant events and the data to be collected and communicated as determined by policy, regulation or risk analysis. It also provides the mechanism to determine the record format to support analytical reports that are needed
HITSP/T16 - Consistent Time	The Consistent Time Transaction provides a mechanism to ensure that all of the entities that are communicating within the network have synchronized system clocks

Construct

Description

HITSP/T15 - Collect and Communicate Security Audit Trail

The Collect and Communicate Security Audit Trail Transaction is a means to provide assurance that security policies are being followed or enforced and that risks are being mitigated. This document describes the mechanisms to define and identify security relevant events and the data to be collected and communicated as determined by policy, regulation or risk analysis. It also provides the mechanism to determine the record format to support analytical reports that are needed

HITSP/T16 - Consistent Time

The Consistent Time Transaction provides a mechanism to ensure that all of the entities that are communicating within the network have synchronized system clocks

1.4 Internal View Diagram with Sequencing (i.e., white box diagram)

1.4.1 Interface: Send Security Audit Event

1.4.1.1 Sequence Details

Pre-conditions	Uses SC, T, TP or C	Interface	Purpose
Time has been synchronized	HITSP/T16 - Consistent Time	Time Client	To synchronize time with well known time source

Step Number	Uses SC, T, TP or C	Interface [2]	Purpose
1	HITSP/T15 - Collect and Communicate Security Audit Trail	Audit Record Source	Record audit event in the repository

Post-conditions	Uses SC, T, TP or C	Interface	Purpose
None

Post-conditions

Uses SC, T, TP or C

Interface

Purpose

None

1.0 Introduction