Mapped to NIST 800-171 Requirement: 3.3.6
CMMC Assessment Objective: AU.L2-3.3.6[b]
What This Objective Means
While AU.L2-3.3.6[a] focused on identifying protection mechanisms, this objective verifies that those mechanisms are actually implemented in your system configurations. You must show that:
• Audit logs are write-protected or append-only
• Only authorized personnel can access or manage audit records
• Logging settings enforce security boundaries that align with your policy
This is where configuration settings must match your security intentions.
Why It Matters
Without technical enforcement:
• Admins or malicious actors could erase or modify logs
• Log data could be lost in the event of a breach
• Your audit trail becomes unreliable or inadmissible for investigation
This control ensures audit integrity is protected by design—not just by documentation.
How to Implement It
• Configure system-level protections, such as:
◦ File system permissions that restrict log file access
◦ Group Policy settings that prevent log overwriting
◦ Security-enhanced log destinations (e.g., remote syslog, write-once storage)
• Limit log access to authorized roles (e.g., security analysts, auditors)
• Use secure transmission protocols (e.g., TLS) if logs are forwarded
• Verify that logs are not stored in user-writable directories
Evidence the Assessor Will Look For
• Screenshots or configuration exports showing:
◦ Log file access control lists (ACLs)
◦ Logging services set to prevent modification or deletion
• System security settings or audit policies aligned with protection goals
• Demonstrations of access restrictions (e.g., failed attempts to delete logs)
• Documentation linking configurations to your policies and procedures
Common Gaps
• Log files stored in default locations accessible by general users or admins
• No enforcement of file protections—logs are editable or deletable
• Forwarded logs sent over unencrypted channels or without verification
How Cuick Trac Helps
Cuick Trac supports this control by:
• Centralizing audit logging in a secure, access-controlled enclave
• Enforcing configuration settings that limit log access and prevent modification
• Using encrypted channels for log forwarding and archival
• Helping you verify and document protective configurations across your environment
With Cuick Trac, your logs are protected not just by policy—but by the system itself.
Final CTA
If logs can be changed, they can’t be trusted.
Schedule a Cuick Trac demo and make sure your system settings lock down audit trail integrity.
