CMMC Practice AU.L2-3.3.9

Audit Management: Limit management of audit logging functionality to a subset of privileged users.

Monarch ISC Guidance

You have likely implemented a SIEM by now, so first limit access to the SIEM to your designated audit manager. Network and server administrators should not have change access to that server. It would be allowable for them to read reports and logs for troubleshooting, but they cannot change settings or delete logs. Next, set up an alert which triggers when logs or logging settings are changed on the hosts. Server and network administrators will often have permissions which on the devices they manage which could affect logging.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Individuals with privileged access to a system and who are also the subject of an audit by that system, may affect the reliability of audit information by inhibiting audit logging activities or modifying audit records. This requirement specifies that privileged access be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges.