CMMC Practice AU.L2-3.3.9 – Audit Management: Limit management of audit logging functionality to a subset of privileged users.
Links to Publicly Available Resources
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. This NIST Special Publication provides practical guidance on developing and maintaining effective log management practices. This link from Norfolk State University serves as is an example of a log review, analysis, and reporting policy. This policy from SANS helps identify requirements that must be met by a system to generate logs. This SANS whitepaper offers common elements to success for log management, in order to prepare for regulatory compliance audits. Learn how to conduct security log management that provides visibility into IT infrastructure activities and traffic, improves troubleshooting and prevents service disruptions.
Discussion [NIST SP 800-171 R2]
Individuals with privileged access to a system and who are also the subject of an audit by that system, may affect the reliability of audit information by inhibiting audit logging activities or modifying audit records. This requirement specifies that privileged access be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges.
Further Discussion
Companies should restrict access to audit logging functions to a limited number of privileged users who can modify audit logs and audit settings. General users should not be granted permissions to perform audit management. All audit managers should be privileged users, but only a small subset of privileged users will be given audit management responsibilities. Functions performed by privileged users must be distinctly separate from the functions performed by users who have audit-related responsibilities to reduce the potential of fraudulent activities by privileged users not being detected or reported. When possible, individuals who manage audit logs should not have access to other privileged functions.