AU.L2-3.3.4
Audit Failure Alerting
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AU.L2-3.3.4 in the reference catalog with its NIST cross-references
Official requirement
Alert in the event of an audit logging process failure.
Assessment objectives
a. personnel or roles to be alerted in the event of an audit logging process failure are identified;
b. types of audit logging process failures for which alert will be generated are defined; and
c. identified personnel or roles are alerted in the event of an audit logging process failure.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Alert responsible personnel when the audit-logging process fails.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of IT operations for a company that processes CUI , and y our responsibilities include managing the audit logging process . You configure your systems to send you an email in the event of an audit log failure. One day, you receive one of these alerts. You connect to the system, restart logging, and determine why the logging stopped [a,b,c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Audit and accountability policy; procedures addressing response to audit logging processing failures; system design documentation; system security plan; system configuration settings and associated documentation; list of personnel to be notified in case of an audit logging processing failure; system incident reports; system audit logs and records; other relevant documents or records
Common mistakes
Discovering logging failures only during an incident investigation.