AU.L2-3.3.6[b] – Examine system configurations to verify that mechanisms are implemented to protect audit information.

This objective requires you to verify that system-level controls are actively configured to protect audit records from unauthorized access, modification, or deletion—particularly in systems handling Controlled Unclassified Information (CUI).

AU.L2-3.3.1[c] – Examine system configurations to verify that the system is configured to generate audit records for the required event types.

This objective requires your organization to confirm, through technical configuration, that your systems are generating audit logs for the events you have identified as required—especially for systems handling Controlled Unclassified Information (CUI).

AU.L2-3.3.1[a] – Identify the types of events that the system is capable of logging.

This objective requires your organization to identify and document the types of security-relevant events your systems are technically capable of logging, particularly in environments handling Controlled Unclassified Information (CUI).

AU.L2-3.3.7[a] – Identify personnel or roles that are assigned to manage audit logging processes.

This objective requires your organization to assign and document responsibility for managing the audit logging process, including the collection, configuration, review, protection, and retention of logs—especially on systems handling Controlled Unclassified Information (CUI).

AU.L2-3.3.7[b] – Examine audit log management processes to determine if audit logging processes are managed.

This objective verifies that your organization’s audit log management processes are actively implemented and maintained, not just defined on paper. It ensures there’s an operational routine in place to manage logs generated by systems that handle Controlled Unclassified Information (CUI).

AU.L2-3.3.9[a] – Identify individuals or roles that are authorized to access audit logs.

This objective requires your organization to formally identify and document which individuals or roles have permission to access audit logs, particularly in systems that handle Controlled Unclassified Information (CUI).

AU.L2-3.3.1[d] – Examine audit records to verify that the system generates audit records for the required event types.

This objective requires you to examine actual audit logs to confirm that your systems are generating the correct events, as defined by your organization’s audit logging requirements—especially on systems that handle Controlled Unclassified Information (CUI).

AU.L2-3.3.9[b] – Examine system configurations to verify that access to audit logs is restricted to authorized individuals.

This objective ensures that your system configurations enforce access control restrictions so that only approved individuals or roles can view, manage, or modify audit logs—especially on systems that handle Controlled Unclassified Information (CUI).

AU.L2-3.3.6[a] – Identify the audit logging processes and mechanisms used to protect audit information.

This objective requires your organization to identify and document the technical methods and processes used to protect audit logs from unauthorized access, modification, or deletion—particularly in environments where Controlled Unclassified Information (CUI) is handled.

AU.L2-3.3.3[a] – Identify personnel or roles that review audit records.

This objective requires your organization to designate and document who is responsible for reviewing audit logs, particularly those related to systems that store, process, or transmit Controlled Unclassified Information (CUI).