NIST 800-53 REV 5 • AUDIT AND ACCOUNTABILITY
AU-9(7) — Store on Component with Different Operating System
Store audit information on a component running a different operating system than the system or component being audited.
Supplemental Guidance
Storing auditing information on a system component running a different operating system reduces the risk of a vulnerability specific to the system, resulting in a compromise of the audit records.
Practitioner Notes
Store audit records on a component running a different operating system than the systems being audited. If an exploit targets Windows, your logs on a Linux SIEM server are not affected by the same exploit.
Example 1: If your production environment is Windows-based, run your SIEM on Linux (Splunk on RHEL, Elastic on Ubuntu). An attacker who exploits a Windows vulnerability cannot use the same technique to compromise your Linux-based log store.
Example 2: Forward Windows event logs to a cloud-based SIEM (Microsoft Sentinel runs on Azure's underlying Linux infrastructure). The cloud platform's operating system and security controls are entirely different from your on-premises Windows environment, providing OS diversity for your log storage.