AU.L2-3.3.8
Audit Protection
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AU.L2-3.3.8 in the reference catalog with its NIST cross-references
Official requirement
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
Assessment objectives
a. audit information is protected from unauthorized access;
b. audit information is protected from unauthorized modification;
c. audit information is protected from unauthorized deletion;
d. audit logging tools are protected from unauthorized access;
e. audit logging tools are protected from unauthorized modification; and
f. audit logging tools are protected from unauthorized deletion.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Protect audit information and logging tools against unauthorized access or changes.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Y ou are in charge of IT operations in a company that handles CUI. Your responsibilities include protecting audit information and audit logging tools. You protect the information from modification or deletion by having audit log events forwarded to a central server and by restricting the local audit logs to only be viewable by the system administrators [a,b,c]. Only a small group of security professionals can view the data on the central audit server [b,c,d]. For an additional layer of protection, you back up the server daily and encrypt the backups before sending them to a cloud data repository [a,b,c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Audit and accountability policy; access control policy and procedures; procedures addressing protection of audit information; system security plan; system design documentation; system configuration settings and associated documentation, system audit logs and records; audit logging tools; other relevant documents or records
Common mistakes
Allowing the people being audited to alter the records without appropriate restrictions.