1Overview
AU.L2-3.3.8 guards the audit trail against tampering. It requires that audit information and the audit logging tools be protected from unauthorized access, modification, and deletion, so that the records an investigation relies on cannot be quietly altered or erased, and the tools that produce them cannot be turned off or subverted. It is a one-point requirement and may be deferred on a plan of action.
The audit trail is only trustworthy if it cannot be changed by the people it might implicate. An attacker who gains access and can edit or delete logs can erase the evidence of the intrusion, and an insider who can alter records can hide their actions. This control protects both the records and the tools: the records from unauthorized access, modification, and deletion, and the logging tools from the same, so that neither the evidence nor the machinery that creates it can be tampered with. It is what makes the rest of the family dependable, because a log that can be edited proves nothing.
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
The requirement names two objects, audit information and audit logging tools, and three protections, against access, modification, and deletion, giving six combinations in the objectives. The protection is usually achieved by restricting who can reach the logs and tools, by collecting records centrally away from the systems that generate them, and by limiting log management to a small set of trusted people, which is the subject of the paired control 3.3.9. The point is that the audit trail must be beyond the reach of those who would have reason to alter it.
2The Assessment Objectives
NIST SP 800-171A decomposes 3.3.8 into six objectives: protect audit information from unauthorized access, modification, and deletion, and protect audit logging tools from the same three.
Audit information is protected from unauthorized access. Only authorized people can reach the audit records.
Audit information is protected from unauthorized modification. The records cannot be altered by unauthorized people.
Audit information is protected from unauthorized deletion. The records cannot be deleted by unauthorized people.
Audit logging tools are protected from unauthorized access. Only authorized people can reach the logging tools.
Audit logging tools are protected from unauthorized modification. The logging tools and their configuration cannot be altered by unauthorized people.
Audit logging tools are protected from unauthorized deletion. The logging tools cannot be removed or disabled by unauthorized people.
The six objectives apply the same three protections, against access, modification, and deletion, to both the records and the tools. The common gap is at objectives [b] and [c], protecting records from modification and deletion, which local-only logs cannot satisfy because an administrator or intruder on the host can clear them. The assessor looks for protection that puts the records and tools beyond the reach of those who would tamper with them.
3Failure Patterns
The failures are about logs that live only where they can be erased and tools anyone can disable.
Local logs an intruder can clear
Logs stored only on the system that generated them can be cleared by anyone with sufficient access to that system, which is exactly what an intruder seeks. Central collection to a separate system, out of the intruder's reach, is the standard protection against modification and deletion.
Logging that can be turned off
Where the logging tools can be disabled or reconfigured by ordinary users or a compromised account, an attacker simply stops the recording. Restricting management of the logging tools, the subject of 3.3.9, protects the machinery from being switched off.
Audit records readable by all
Records that anyone with system access can read expose who did what to people with no need to know, failing objective [a]. Access to audit information should be limited to authorized roles.
No separation between actor and auditor
When the same people who perform actions also control the logs of those actions without oversight, the audit trail can be edited by the very people it records. Central collection and restricted management separate the actor from the record.
4Ownership
This is an IT-owned technical control, and its main move is central collection plus restricted access to logs and logging tools.
| Role | Responsibility for this control |
|---|---|
| IT and system administrator | Restricts access to audit records and tools, collects records centrally beyond local tampering, and limits who can change logging. Owns the technical evidence. |
| Security or compliance lead | Confirms records and tools are protected against access, modification, and deletion, and that separation from ordinary users holds. |
| Program lead | Includes audit protection in periodic review and retains the configuration evidence. |
5Tooling
The control is delivered by access restrictions on logs and tools and by central collection that removes records from local reach.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a], [d] | Access controls on audit logs and logging configuration | Restriction of who can read the records and reach the tools. |
| [b], [c] | Central log collection or SIEM, write-once or protected storage | Records held where users cannot modify or delete them, surviving local clearing. |
| [e], [f] | Restricted logging management, protected agents | Logging tools that ordinary users cannot reconfigure, disable, or remove. |
| Separation | Limited audit management, see 3.3.9 | Separation of the people who act from control over the records of their actions. |
The caveat is that local protection alone is weak, because whoever controls the host can usually reach its local logs. Central collection to a system beyond the reach of ordinary users and intruders is what genuinely protects the records from modification and deletion. The assessor examines whether the records and tools can be tampered with by those they might implicate, so the separation central collection provides is central to meeting the control.
6Evidence
The satisfied version of 3.3.8 shows protected records and tools, beyond the reach of ordinary users.
| Evidence | What it demonstrates |
|---|---|
| Access controls on logs and tools | Objectives [a], [d]. Restriction of access to records and logging tools. |
| Central collection configuration | Objectives [b], [c]. Records held where they cannot be modified or deleted locally. |
| Logging tool protection | Objectives [e], [f]. Tools that cannot be reconfigured or removed by ordinary users. |
| Restricted management | Objectives [b], [e]. Limited control over logging, tied to 3.3.9. |
The evidence should show that neither the records nor the tools can be tampered with by the people they might implicate, which central collection and restricted access demonstrate. Configuration of protected, central records and restricted logging management is the clearest demonstration of the control.
A log an intruder can erase proves nothing
Records kept only on the system that made them can be cleared by whoever compromises that system, which is the first thing an intruder does. Getting logs off the host to protected central storage and locking down the logging tools is part of the onsite readiness work this practice does.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.3.8. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.3.8[a] through 3.3.8[f]. csrc.nist.gov
- 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov