CMMC Practice AU.L2-3.3.9 – Audit Management: Limit management of audit logging functionality to a subset of privileged users.
Links to Publicly Available Resources
CMMC CLARIFICATION (Ref CMMC – Appendix B)
Organizations should restrict access to audit logging functions to a limited number of privileged users that can modify audit logs and audit settings. There are three classes of users: general users, privileged users, and audit managers. General users should not be granted permissions to perform audit management. All audit managers should come from the set of privileged users, but only a small subset of privileged users will be given audit management responsibilities. Functions performed by privileged users must be distinctly separate from the functions performed by users who have audit-related responsibilities to reduce the potential of fraudulent activities by privileged users not being detected or reported.