NIST 800-171 3.3.4 (AU.L2-3.3.4): Audit Failure Alerts

What 3.3.4 means in practice

If logging stops, someone must find out. Define which failures matter (an agent stops sending, storage fills up, a log source goes quiet) and who is alerted, then configure alerts that actually reach those people.

SPRS points and the CMMC POA&M

What an assessor checks for 3.3.4

NIST SP 800-171A gives 3 determination statements for 3.3.4, each found satisfied or other than satisfied. Determine if:

1. 3.3.4[a] personnel or roles to be alerted in the event of an audit logging process failure are identified.
2. 3.3.4[b] types of audit logging process failures for which alert will be generated are defined.
3. 3.3.4[c] identified personnel or roles are alerted in the event of an audit logging process failure.

NIST SP 800-171A (June 2018), assessment objectives for 3.3.4

Evidence that shows 3.3.4 is met

• The list of audit logging failures that raise an alert, and the roles alerted.
• Alert rule configuration in the logging or monitoring platform.
• A record of a test or real alert reaching the named people.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.3.4 from it. Each line says what the product checks.

• Azure Monitor: Alert rules. Reads Azure Monitor alert rules and checks that alerts are set for audit logging process failures.