AU.L2-3.3.9  

Reference: CMMC v2.13

Family: AU

Level Introduced: 2

Title: Audit Management

Practice:
Limit management of audit logging functionality to a subset of privileged users.

Further Discussion:
Companies should restrict access to audit logging functions to a limited number of privileged users who can modify audit logs and audit settings. General users should not be granted permissions to perform audit management. All audit managers should be privileged users, but only a small subset of privileged users will be given audit management responsibilities. Functions performed by privileged users must be distinctly separate from the functions performed by users who have audit-related responsibilities to reduce the potential of fraudulent activities by privileged users not being detected or reported. When possible, individuals who manage audit logs should not have access to other privileged functions.

Example
You are responsible for the administration of select company infrastructure that contains CUI, but you are not responsible for managing audit information. You are not permitted to review audit logs, delete audit logs, or modify audit log settings [b]. Full control of audit logging functions has been given to senior system administrators [a,b]. This separation of system administration duties from audit logging management is necessary to prevent possible log file tampering.

Potential Assessment Considerations
• Are audit records of nonlocal accesses to privileged accounts and the execution of privileged functions protected [b]?

Source: CMMC v2.13