Audit Management

Official Source Material

SPRS score value: 1 point.
POA&M eligibility: Eligible at a conditional assessment.
Level 1: Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Limit management of audit logging functionality to a subset of privileged users.

Determine if:

[a] a subset of privileged users granted access to manage audit logging functionality is defined; and
[b] management of audit logging functionality is limited to the defined subset of privileged users.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Define the subset in writing even when it is everyone in IT.

Objective [a] asks for a defined subset of privileged users who manage audit logging. In a two admin shop where both need coverage, both go on the list. What fails is not a small subset. It is the absence of a definition.

Separate audit management from general administration where headcount allows.

An administrator who is the subject of the logs and also controls them can hide their own tracks. Give routine administrators no rights over audit settings and put log management in fewer hands. In a cloud tenant, use a dedicated role for log management instead of handing out global administration.

When the same people must hold both, have them watch each other.

With one or two administrators, have them review each other's activity during log review and record that they did. The mutual review compensates for the separation you cannot achieve, and the record shows you saw the risk and addressed it.

What falls short

Audit settings changeable by every privileged account with no defined list. Objective [a] has nothing to point at, and [b] cannot be true.

Edge cases

A managed service provider administers your logging. The provider's technicians are your subset, so define them by role in your documentation and require the provider to notify you when the roster changes.

Over-engineering

A privileged access management product to gate the audit settings. Objectives [a] and [b] are a named subset of privileged users and the role assignment behind it.
An audit administrator hired to hold the role alone. Where headcount does not allow separation, define the subset you have and record how they check each other.