Audit and Accountability 3.3.8 (3.3.8)
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
Get Full GuidanceWhat Is This CMMC Control?
This control requires organizations to protect audit logs and the tools used to create them from unauthorized changes, deletion, or access. Think of audit logs as your security camera footage - you need to ensure no one can tamper with or erase the recordings. This includes protecting both the log files themselves and the software/systems that generate and manage them. The goal is to maintain the integrity and availability of your audit trail so you can trust it during investigations or assessments.
Control Intent
Ensure the integrity, availability, and confidentiality of audit records and audit tools so that security events can be reliably investigated and compliance can be demonstrated without concern that evidence has been tampered with or destroyed.
Who This Control Applies To
- •All systems that generate, store, or process audit logs
- •Centralized logging systems and SIEM platforms
- •Audit log management tools and utilities
- •Systems with administrative access to logging configurations
- •Backup systems containing archived audit logs
- •Cloud-based logging services and log forwarding infrastructure
Not Applicable When
- •Systems that do not process, store, or transmit CUI and are completely outside the assessment scope
- •Standalone systems with no audit logging capability where AC.L2-3.3.1 through 3.3.7 are also not applicable
- •Systems where audit logs are generated but immediately forwarded to a protected centralized system with no local retention
Key Objectives
- 1Prevent unauthorized modification or deletion of audit records to maintain evidence integrity
- 2Restrict access to audit logging tools and configurations to authorized personnel only
- 3Ensure audit information remains available and trustworthy for security investigations and compliance verification
Sample Self-Assessment Questions (Partial)
Where are your audit logs stored (local systems, centralized server, cloud service)?
Who currently has access to view, modify, or delete audit logs?
Implementation Approaches (High-Level)
Centralized SIEM with Role-Based Access Control
Forward all audit logs to a centralized SIEM or log management platform that enforces strict role-based access controls, preventing unauthorized access, modification, or deletion.
File System Permissions and Immutable Flags
Protect audit logs on local or centralized systems using restrictive file system permissions and immutable file attributes to prevent unauthorized modification or deletion.
Write-Once or Immutable Cloud Storage
Store audit logs in cloud storage services configured with write-once-read-many (WORM) or object lock features that prevent modification or deletion for a defined retention period.
Dedicated Log Server with Network Segmentation
Deploy a dedicated, hardened log server in a separate network segment with strict access controls and no direct administrative access from system administrators.
Audit Logging Tool Access Controls
Restrict access to audit logging tools, utilities, and management consoles to authorized security personnel through authentication, authorization, and audit trails.
Evidence & Assessment Notes
Expected Evidence
Organizations should maintain documentation and evidence demonstrating compliance with this control. This may include policy documentation, configuration records, audit logs, access reviews, and other relevant artifacts that show how the control is implemented and maintained.
Plan of Action & Milestones (POA&M)
If audit logs are currently accessible to system administrators without oversight, prioritize implementing centralized logging with segregated access as a high-priority remediation If no centralized logging exists, consider phased implementation starting with critical systems and expanding to all in-scope systems For organizations without SIEM capability, implement file system protections and dedicated log servers as an interim measure If cloud-based logs lack immutability controls, enable object lock or immutability policies as a quick win Document compensating controls if technical limitations prevent full implementation (e.g., small environments where segregation of duties is not feasible) Include milestones for implementing MFA and RBAC for logging tool access if not currently in place Address log retention and storage capacity issues that may lead to premature log deletion Plan for regular testing of log protection mechanisms to ensure they remain effective
Frequently Asked Questions
Does this control require that audit logs be stored separately from the systems that generate them?
While not explicitly required, centralized logging is the most common and effective way to satisfy this control. Storing logs on the same system where they are generated makes it difficult to prevent system administrators from modifying or deleting them. Centralized logging with proper access controls is the preferred implementation for most environments.
Can system administrators have read-only access to audit logs, or must access be completely restricted?
System administrators can have read-only access to audit logs if there is a business need and it is properly authorized and documented. However, they must not be able to modify, delete, or disable logging. The key requirement is preventing unauthorized changes to logs, not necessarily preventing all access. Many organizations implement segregation of duties where system administrators cannot access logs for systems they manage.
What happens if we need to delete old audit logs due to storage constraints?
Deletion of audit logs must be authorized and performed according to a documented retention policy that meets compliance requirements (typically 90 days minimum for CMMC Level 2). Automated deletion based on retention policies is acceptable if properly configured and documented. The control is focused on preventing unauthorized or premature deletion, not preventing all deletion. Ensure that log deletion is itself logged and that only authorized processes or personnel can perform it.
How is this control verified during a CMMC assessment?
Assessors will examine your logging infrastructure to verify that technical controls prevent unauthorized access, modification, and deletion of logs. This includes reviewing access controls on SIEM platforms, file system permissions, IAM policies, and logging tool access restrictions. Assessors will also review who has access to logs and logging tools, and may test whether unauthorized users can modify or delete logs. Evidence must demonstrate that protections are consistently applied across all in-scope systems.
Do we need to encrypt audit logs to satisfy this control?
Encryption is not explicitly required by this control, but it is a common and recommended practice. Encryption protects the confidentiality of audit logs, which may contain sensitive information. This control focuses primarily on integrity (preventing modification) and availability (preventing deletion), but encryption supports these objectives by preventing unauthorized viewing and tampering. Many acceptable implementations include encryption as part of a defense-in-depth approach.
What if our cloud provider has administrative access to our audit logs?
When using cloud services, you must ensure that your cloud provider's access to logs is authorized and documented. Use cloud-native controls like IAM policies, object lock, and immutability settings to protect logs from unauthorized modification or deletion. Review your cloud provider's compliance certifications and shared responsibility model. In most cases, properly configured cloud logging services (e.g., AWS CloudTrail with S3 object lock) can satisfy this control even though the cloud provider has underlying infrastructure access.
How ConformatIQ Helps With CMMC Readiness
ConformatIQ is an AI-assisted CMMC readiness platform designed to help organizations prepare for assessments more efficiently. The platform supports document generation such as SSPs and POA&Ms, guided readiness workflows, centralized evidence tracking, and interview preparation for assessments.
Ready to Get Full Guidance?
Access complete implementation details, detailed assessment questions, evidence requirements, and expert guidance for this control.
Request Full GuidanceInformation sourced from NIST SP 800-171 Rev. 2. See full disclaimer.