AU.L2-3.3.9
Audit Management
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AU.L2-3.3.9 in the reference catalog with its NIST cross-references
Official requirement
Limit management of audit logging functionality to a subset of privileged users.
Assessment objectives
a. a subset of privileged users granted access to manage audit logging functionality is defined; and
b. management of audit logging functionality is limited to the defined subset of privileged users.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Restrict audit-logging management to an appropriate subset of privileged users.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for the administration of select company infrastructure that contains CUI, but you are not responsible for managing audit information. You are not permitted to review audit logs, delete audit logs, or modify audit log settings [b]. Full control of audit logging functions has been given to senior system administrators [a,b]. This separation of system administration duties from audit logging management is necessary to prevent possible log file tampering.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Audit and accountability policy; access control policy and procedures; procedures addressing protection of audit information; system security plan; system design documentation; system configuration setting s and associated documentation; access authorizations; system-generated list of privileged users with access to management of audit logging functionality; access control list; system audit logs and records; other relevant documents or records
Common mistakes
Giving every administrator unrestricted control over logging functions.