CMMC Practice AU.L2-3.3.4

Audit Failure Alerting: Alert in the event of an audit logging process failure.

Monarch ISC Guidance

This practice requires the implementation of a system which is automatically reviewing system logs and sending notifications. That security information and event management system, or SIEM, will do a lot more for your organization, too. Notice that this practice also requires a system to monitor hardware and network connectivity. This is an fairly routine system to alert staff to operational issues, but now also provides a way to know if your SIEM itself is malfunctioning.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Audit logging process failures include software and hardware errors, failures in the audit record capturing mechanisms, and audit record storage capacity being reached or exceeded. This requirement applies to each audit record data storage repository (i.e., distinct system component where audit records are stored), the total audit record storage capacity of organizations (i.e., all audit record data storage repositories combined), or both.