Audit Protection

Access control carries all six objectives.

Restrict who can read audit information for [a] and who can open the tools for [d]. Grant nobody modification rights for [b] and [e]. Confine deletion to the few who manage retention for [c] and [f]. The evidence is a role definition plus the list of people who hold the role.

Forward logs off the systems that generate them.

An administrator whose actions are being logged can clear a local log. A copy that ships to a central store as events occur means clearing the local log destroys nothing, and the clearing itself becomes an event in the central copy.

The tools and settings are protected, not just the data.

Objectives [d], [e], and [f] cover the audit configuration and tooling. Restrict who can change audit policy, who can reconfigure log collection, and who can administer the log platform. Keep that list aligned with the subset you define under AU.L2-3.3.9.

In a cloud tenant this is a role review.

List which directory roles can read, export, or purge audit data, and cut the list to the people who need it. Protect exported log archives with the same restraint, because an export anyone can read undoes [a] no matter how tight the portal is.