NIST 800-171 3.3.9 (AU.L2-3.3.9): Audit Management

What 3.3.9 means in practice

Only a small, named group of privileged users may change logging settings, such as turning logs off or changing what is captured. Other administrators keep their remaining privileges but not this one, so they cannot hide their own actions.

SPRS points and the CMMC POA&M

What an assessor checks for 3.3.9

NIST SP 800-171A gives 2 determination statements for 3.3.9, each found satisfied or other than satisfied. Determine if:

1. 3.3.9[a] a subset of privileged users granted access to manage audit logging functionality is defined.
2. 3.3.9[b] management of audit logging functionality is limited to the defined subset of privileged users.

NIST SP 800-171A (June 2018), assessment objectives for 3.3.9

Evidence that shows 3.3.9 is met

• The named subset of users allowed to manage audit logging.
• Role assignments showing logging management limited to that group.
• Change records for logging configuration, made only by members of that group.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.3.9 from it. Each line says what the product checks.

• Azure: Role assignments. Checks that Azure role assignments limit management of audit logging to authorized administrators.