diff --git a/components/audit.yml b/components/audit.yml
index 018ead72842..d7271c6b618 100644
--- a/components/audit.yml
+++ b/components/audit.yml
@@ -326,7 +326,9 @@ rules:
 - file_ownership_var_log_audit
 - file_ownership_var_log_audit_stig
 - file_permissions_audit_configuration
+- file_permissions_audit_configuration_stig
 - file_permissions_etc_audit_auditd
+- file_permissions_etc_audit_auditd_stig
 - file_permissions_etc_audit_rulesd
 - file_permissions_etc_audit_rules
 - file_permissions_var_log_audit
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/policy/stig/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/policy/stig/shared.yml
new file mode 100644
index 00000000000..e1dcf142500
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/policy/stig/shared.yml
@@ -0,0 +1,21 @@
+srg_requirement: |-
+    {{{ full_name }}} must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
+
+fixtext: |-
+    Configure the files in directory "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file to have a mode of "0600" with the following commands:
+
+    $ sudo chmod 0600 /etc/audit/rules.d/audit.rules
+    $ sudo chmod 0600 /etc/audit/rules.d/[customrulesfile].rules
+    $ sudo chmod 0600 /etc/audit/auditd.conf
+
+checktext: |-
+    Verify that the files in directory "/etc/audit/rules.d/" and "/etc/audit/auditd.conf" file have a mode of "0600" or less permissive with the following command:
+
+    $ sudo find /etc/audit/rules.d/ /etc/audit/audit.rules /etc/audit/auditd.conf -type f -exec stat -c "%a %n" {} \;
+
+    600 /etc/audit/rules.d/audit.rules
+    600 /etc/audit/audit.rules
+    600 /etc/audit/auditd.conf
+
+vuldiscussion: |-
+    Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/rule.yml
new file mode 100644
index 00000000000..b1999484c00
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/rule.yml
@@ -0,0 +1,42 @@
+documentation_complete: true
+
+title: 'Audit Configuration Files Permissions are 600 or More Restrictive'
+
+description: |-
+    All audit configuration files permissions must be 600 or more restrictive.
+    <pre>chmod 0600 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</pre>
+
+rationale: |-
+    Without the capability to restrict which roles and individuals can
+    select which events are audited, unauthorized personnel may be able
+    to prevent the auditing of critical events.
+    Misconfigured audits may degrade the system's performance by
+    overwhelming the audit log. Misconfigured audits may also make it more
+    difficult to establish, correlate, and investigate the events relating
+    to an incident or identify those responsible for one.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-89815-5
+    cce@rhel9: CCE-88792-7
+
+references:
+    nist: AU-12 b
+    srg: SRG-OS-000063-GPOS-00032
+
+ocil: |-
+    {{{ describe_file_permissions(file="/etc/audit/", perms="0600") }}}
+    {{{ describe_file_permissions(file="/etc/audit/rules.d/", perms="0600") }}}
+
+template:
+    name: file_permissions
+    vars:
+        filepath:
+            - /etc/audit/
+            - /etc/audit/rules.d/
+        file_regex:
+            - ^.*audit(\.rules|d\.conf)$
+            - ^.*\.rules$
+        allow_stricter_permissions: "true"
+        filemode: '0600'
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/correct_permissions.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/correct_permissions.pass.sh
new file mode 100644
index 00000000000..6cb38957979
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/correct_permissions.pass.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = audit
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+touch $TESTFILE
+touch $AUDITFILE
+chmod 0600 $TESTFILE
+chmod 0600 $AUDITFILE
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/lenient_permissions.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/lenient_permissions.fail.sh
new file mode 100644
index 00000000000..c4a46f45543
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/lenient_permissions.fail.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = audit
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+touch $TESTFILE
+touch $AUDITFILE
+chmod 0640 $TESTFILE
+chmod 0640 $AUDITFILE
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/stricter_permisions.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/stricter_permisions.pass.sh
new file mode 100644
index 00000000000..497ae4f080a
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/stricter_permisions.pass.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = audit
+
+export TESTFILE=/etc/audit/rules.d/test_rule.rules
+export AUDITFILE=/etc/audit/auditd.conf
+touch $TESTFILE
+touch $AUDITFILE
+chmod 0400 $TESTFILE
+chmod 0400 $AUDITFILE
diff --git a/linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/policy/stig/shared.yml b/linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/policy/stig/shared.yml
new file mode 100644
index 00000000000..bb821f262d6
--- /dev/null
+++ b/linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/policy/stig/shared.yml
@@ -0,0 +1,19 @@
+srg_requirement: |-
+    {{{ full_name }}} /etc/audit/auditd.conf file must have 0600 or less permissive to prevent unauthorized access.
+
+vuldiscussion: |-
+    Without the capability to restrict the roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
+
+checktext: |-
+    Verify the mode of /etc/audit/auditd.conf with the command:
+
+    $ sudo stat -c "%a %n" /etc/audit/auditd.conf
+
+    600 /etc/audit/auditd.conf
+
+    If "/etc/audit/auditd.conf" does not have a mode of "0600", this is a finding.
+
+fixtext: |-
+    Set the mode of /etc/audit/auditd.conf file to 0600 with the command:
+
+    $ sudo chmod 0600 /etc/audit/auditd.conf
diff --git a/linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/rule.yml b/linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/rule.yml
new file mode 100644
index 00000000000..e7950604503
--- /dev/null
+++ b/linux_os/guide/auditing/file_permissions_auditd/file_permissions_etc_audit_auditd_stig/rule.yml
@@ -0,0 +1,43 @@
+documentation_complete: true
+
+
+title: 'Verify Permissions on /etc/audit/auditd.conf'
+
+description: |-
+    {{{ describe_file_permissions(file="/etc/audit/auditd.conf", perms="0600") }}}
+
+
+rationale: |-
+    Without the capability to restrict the roles and individuals that can select which events
+    are audited, unauthorized personnel may be able to prevent the auditing of critical
+    events. Misconfigured audits may degrade the system's performance by overwhelming
+    the audit log. Misconfigured audits may also make it more difficult to establish,
+    correlate, and investigate the events relating to an incident or identify
+    those responsible for one.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-89841-1
+    cce@rhel9: CCE-88950-1
+
+references:
+    nist: AU-12(b)
+    srg: SRG-OS-000063-GPOS-00032
+
+ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/audit/auditd.conf", perms="-rw-------") }}}'
+
+ocil: |-
+    {{{ ocil_file_permissions(file="/etc/audit/auditd.conf", perms="-rw-------") }}}
+
+fixtext: |-
+    {{{ describe_file_permissions(file="/etc/audit/auditd.conf", perms="0600") }}}
+
+srg_requirement: '{{{ srg_requirement_file_permission(file="/etc/audit/auditd.conf", mode="0600")}}}'
+
+template:
+    name: file_permissions
+    vars:
+      filepath: /etc/audit/auditd.conf
+      allow_stricter_permissions: "true"
+      filemode: '0600'
diff --git a/products/rhel8/controls/stig_rhel8.yml b/products/rhel8/controls/stig_rhel8.yml
index 52b6656d3b5..c5a2acd5ccf 100644
--- a/products/rhel8/controls/stig_rhel8.yml
+++ b/products/rhel8/controls/stig_rhel8.yml
@@ -1981,8 +1981,8 @@ controls:
       title: RHEL 8 must allow only the Information System Security Manager (ISSM) (or individuals or
           roles appointed by the ISSM) to select which auditable events are to be audited.
       rules:
-          - file_permissions_etc_audit_auditd
-          - file_permissions_etc_audit_rulesd
+          - file_permissions_etc_audit_auditd_stig
+          - file_permissions_audit_configuration_stig
       status: automated
 
     - id: RHEL-08-030620
diff --git a/products/rhel8/profiles/default.profile b/products/rhel8/profiles/default.profile
index 7e7401a04ac..dcc23c94596 100644
--- a/products/rhel8/profiles/default.profile
+++ b/products/rhel8/profiles/default.profile
@@ -739,3 +739,5 @@ selections:
     - sshd_use_approved_kex_ordered_stig
     - accounts_user_dot_no_world_writable_programs
     - package_dnsmasq_removed
+    - file_permissions_etc_audit_rulesd
+    - file_permissions_etc_audit_auditd
diff --git a/products/rhel9/controls/stig_rhel9.yml b/products/rhel9/controls/stig_rhel9.yml
index da1d01354a4..2b984c298e8 100644
--- a/products/rhel9/controls/stig_rhel9.yml
+++ b/products/rhel9/controls/stig_rhel9.yml
@@ -3403,8 +3403,8 @@ controls:
           or
           roles appointed by the ISSM) to select which auditable events are to be audited.
       rules:
-          - file_permissions_audit_configuration
-          - file_permissions_etc_audit_auditd
+          - file_permissions_audit_configuration_stig
+          - file_permissions_etc_audit_auditd_stig
       status: automated
 
     - id: RHEL-09-653120
diff --git a/products/rhel9/profiles/default.profile b/products/rhel9/profiles/default.profile
index a8808393763..34181462a77 100644
--- a/products/rhel9/profiles/default.profile
+++ b/products/rhel9/profiles/default.profile
@@ -594,3 +594,4 @@ selections:
     - configure_ssh_crypto_policy
     - accounts_user_dot_no_world_writable_programs
     - package_dnsmasq_removed
+    - file_permissions_etc_audit_auditd
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 34af55aa4b7..001eed1b844 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -1173,7 +1173,6 @@ CCE-88787-7
 CCE-88788-5
 CCE-88790-1
 CCE-88791-9
-CCE-88792-7
 CCE-88794-3
 CCE-88795-0
 CCE-88798-4
@@ -1251,7 +1250,6 @@ CCE-88944-4
 CCE-88945-1
 CCE-88946-9
 CCE-88949-3
-CCE-88950-1
 CCE-88951-9
 CCE-88952-7
 CCE-88953-5
@@ -1749,7 +1747,6 @@ CCE-89806-4
 CCE-89810-6
 CCE-89812-2
 CCE-89814-8
-CCE-89815-5
 CCE-89817-1
 CCE-89818-9
 CCE-89819-7
@@ -1769,7 +1766,6 @@ CCE-89837-9
 CCE-89838-7
 CCE-89839-5
 CCE-89840-3
-CCE-89841-1
 CCE-89845-2
 CCE-89846-0
 CCE-89847-8
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 9a939cdca49..42d669f73d9 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -194,9 +194,9 @@ file_ownership_binary_dirs
 file_ownership_library_dirs
 file_ownership_var_log_audit_stig
 file_permission_user_init_files_root
+file_permissions_audit_configuration_stig
 file_permissions_binary_dirs
-file_permissions_etc_audit_auditd
-file_permissions_etc_audit_rulesd
+file_permissions_etc_audit_auditd_stig
 file_permissions_home_directories
 file_permissions_library_dirs
 file_permissions_sshd_private_key
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index f84ed5a179e..829fb57402e 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -194,9 +194,9 @@ file_ownership_binary_dirs
 file_ownership_library_dirs
 file_ownership_var_log_audit_stig
 file_permission_user_init_files_root
+file_permissions_audit_configuration_stig
 file_permissions_binary_dirs
-file_permissions_etc_audit_auditd
-file_permissions_etc_audit_rulesd
+file_permissions_etc_audit_auditd_stig
 file_permissions_home_directories
 file_permissions_library_dirs
 file_permissions_sshd_private_key
diff --git a/tests/data/profile_stability/rhel9/stig.profile b/tests/data/profile_stability/rhel9/stig.profile
index 502862e943f..b9509559b1b 100644
--- a/tests/data/profile_stability/rhel9/stig.profile
+++ b/tests/data/profile_stability/rhel9/stig.profile
@@ -247,14 +247,14 @@ file_ownership_audit_configuration
 file_ownership_binary_dirs
 file_ownership_library_dirs
 file_permission_user_init_files_root
-file_permissions_audit_configuration
+file_permissions_audit_configuration_stig
 file_permissions_backup_etc_group
 file_permissions_backup_etc_gshadow
 file_permissions_backup_etc_passwd
 file_permissions_backup_etc_shadow
 file_permissions_binary_dirs
 file_permissions_cron_not_modified
-file_permissions_etc_audit_auditd
+file_permissions_etc_audit_auditd_stig
 file_permissions_etc_group
 file_permissions_etc_gshadow
 file_permissions_etc_passwd
diff --git a/tests/data/profile_stability/rhel9/stig_gui.profile b/tests/data/profile_stability/rhel9/stig_gui.profile
index 23d66d2f06d..425e44c3d60 100644
--- a/tests/data/profile_stability/rhel9/stig_gui.profile
+++ b/tests/data/profile_stability/rhel9/stig_gui.profile
@@ -247,14 +247,14 @@ file_ownership_audit_configuration
 file_ownership_binary_dirs
 file_ownership_library_dirs
 file_permission_user_init_files_root
-file_permissions_audit_configuration
+file_permissions_audit_configuration_stig
 file_permissions_backup_etc_group
 file_permissions_backup_etc_gshadow
 file_permissions_backup_etc_passwd
 file_permissions_backup_etc_shadow
 file_permissions_binary_dirs
 file_permissions_cron_not_modified
-file_permissions_etc_audit_auditd
+file_permissions_etc_audit_auditd_stig
 file_permissions_etc_group
 file_permissions_etc_gshadow
 file_permissions_etc_passwd