Mapped to NIST 800-171 Requirement: 3.3.6
CMMC Assessment Objective: AU.L2-3.3.6[a]
What This Objective Means
This control focuses on identifying the defensive controls in place to preserve the integrity of audit logs, such as:
• Access control mechanisms
• Role-based restrictions
• Log forwarding to secure storage
• Use of write-once or append-only storage
• Application or SIEM security configurations
The goal is to protect audit records from being altered or deleted by unauthorized users—either maliciously or accidentally.
Why It Matters
Audit logs are often a target for attackers trying to cover their tracks. Without protections:
• Logs may be erased or edited
• Unauthorized users may gain access to sensitive monitoring data
• The trustworthiness of your audit trail is compromised
This objective ensures that audit log integrity and confidentiality are maintained.
How to Implement It
• Identify where and how logs are protected in your environment, including:
◦ Access restrictions (e.g., logs viewable only by security staff)
◦ Permissions for log file creation, reading, and modification
◦ Network segmentation between systems and log storage
◦ Forwarding logs to secure, centralized servers
• Document these mechanisms in your:
◦ System Security Plan (SSP)
◦ Audit and Accountability Policy
◦ Network or architecture diagrams
Evidence the Assessor Will Look For
• A description of how your systems protect audit logs from modification or deletion
• Access control lists (ACLs) or role definitions restricting log access
• Documentation showing use of secure log transport or immutable storage
• Logging architecture diagrams showing isolation of log data
Common Gaps
• Logs are stored locally without access controls
• Admins can delete or overwrite logs without detection
• No centralized log storage, making logs easier to tamper with or lose
How Cuick Trac Helps
Cuick Trac supports this control by:
• Storing logs in a secure enclave environment with role-based access restrictions
• Preventing tampering through centralized log collection and retention
• Enabling log forwarding, encryption, and access logging to monitor and enforce protection
• Helping document your logging architecture and protective mechanisms
With Cuick Trac, your logs are protected from the moment they’re created—no matter where they come from.
Final CTA
Your audit logs are only as good as your ability to protect them.
Schedule a Cuick Trac demo and build a tamper-resistant logging strategy from the start.