Requirements / Audit and Accountability (AU)
AU.L2-3.3.9
Audit Management
Official Source Material
Limit management of audit logging functionality to a subset of privileged users.
Determine if:
- [a] a subset of privileged users granted access to manage audit logging functionality is defined; and
- [b] management of audit logging functionality is limited to the defined subset of privileged users.
Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024
Practitioner Guidance
How to meet it
Define the subset in writing even when it is everyone in IT.
Objective [a] asks for a defined subset of privileged users who manage audit logging. In a two admin shop where both need coverage, both go on the list. What fails is not a small subset. It is the absence of a definition.
Separate audit management from general administration where headcount allows.
An administrator who is the subject of the logs and also controls them can hide their own tracks. Give routine administrators no rights over audit settings and put log management in fewer hands. In a cloud tenant, use a dedicated role for log management instead of handing out global administration.
When the same people must hold both, have them watch each other.
With one or two administrators, have them review each other's activity during log review and record that they did. The mutual review compensates for the separation you cannot achieve, and the record shows you saw the risk and addressed it.
What falls short
- Audit settings changeable by every privileged account with no defined list. Objective [a] has nothing to point at, and [b] cannot be true.
Edge cases
- A managed service provider administers your logging. The provider's technicians are your subset, so define them by role in your documentation and require the provider to notify you when the roster changes.