Level 5 CMMC - CMMC Practices

AU.3.050  

Reference: CMMC 1.02

Family: AU

Level Introduced: 3

Practice:
Limit management of audit logging functionality to a subset of privileged users.

CMMC Clarification:
Organizations should restrict access to audit logging functions to a limited number of privileged users that can modify audit logs and audit settings. There are three classes of users: general users, privileged users, and audit managers. General users should not be granted permissions to perform audit management. All audit managers should come from the set of privileged users, but only a small subset of privileged users will be given audit management responsibilities. Functions performed by privileged users must be distinctly separate from the functions performed by users who have audit-related responsibilities to reduce the potential of fraudulent activities by privileged users not being detected or reported.

Example
You are in charge of IT operations in your organization. You are responsible for the administration of the infrastructure, but you are not an audit manager and cannot review audit logs, delete audit logs, or modify audit log settings. Full control of audit logging functions has been given to the security auditors, and they are able to review logs and modify audit log settings. This separation of system administration duties from audit logging management is necessary to prevent possible log file tampering.

3.3.9

Limit management of audit logging functionality to a subset of privileged users.

Discussion:
Individuals with privileged access to a system and who are also the subject of an audit by that system, may affect the reliability of audit information by inhibiting audit logging activities or modifying audit records. This requirement specifies that privileged access be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges.

Source: NIST Special Publication 800-171 Rev. 2

AU-6 (7)

AUDIT REVIEW, ANALYSIS, AND REPORTING | PERMITTED ACTIONS

Description:
The organization specifies the permitted actions for each [Selection (one or more): information system process; role; user] associated with the review, analysis, and reporting of audit information.

Supplemental Guidance:
Organizations specify permitted actions for information system processes, roles, and/or users associated with the review, analysis, and reporting of audit records through account management techniques. Specifying permitted actions on audit information is a way to enforce the principle of least privilege. Permitted actions are enforced by the information system and include, for example, read, write, execute, append, and delete.

AU-9 (4)

PROTECTION OF AUDIT INFORMATION | ACCESS BY SUBSET OF PRIVILEGED USERS

Description:
The organization authorizes access to management of audit functionality to only [Assignment: organization-defined subset of privileged users].

Supplemental Guidance:
Individuals with privileged access to an information system and who are also the subject of an audit by that system, may affect the reliability of audit information by inhibiting audit activities or modifying audit records. This control enhancement requires that privileged access be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges. Related control: AC-5.

Source: NIST Special Publication 800-53 Rev. 4

Source: CMMC v1.02