CMMC Practice Number: AU.L2-3.3.1
CMMC Level: 2 CMMC Domain: Audit and Accountability (AU)
Practice Summary:
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Contents:
CMMC Practice Implementation |
Assessment Objectives
Determine if:
[a] audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified;
[b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined;
[c] audit records are created (generated);
[d] audit records, once created, contain the defined content;
[e] retention requirements for audit records are defined; and
[f] audit records are retained as defined.
Practice Clarification (DOD, CMU)
Contractors must ensure that all applicable systems create and retain audit logs that contain enough information to identify and investigate potentially unlawful or unauthorized system activity [c,d,e]. Contractors must define the audit logs it needs to collect as well as the specific events to capture within the selected logs [a,b]. Captured audit records are checked to verify that they contain the required events [c,d].
In defining the audit log retention period, contractors must ensure that logs are retained for a sufficiently long period to allow for the investigation of a security event. The retention period must take into account the delay of weeks or months that can occur between an initial compromise and the discovery of attacker activity [e,f].
Example
You set up audit logging capability for your company. You determine that all systems that contain CUI must have extra detail in the audit logs. Because of this, you configure these systems to log the following information for all user actions [b,c]:
• time stamps,
• source and destination addresses,
• user or process identifiers,
• event descriptions,
• success or fail indications, and
• filenames.
Potential Assessment Considerations
• Are audit log retention requirements appropriate to the system and its associated level of risk [e]?
Where To Look
- Audit and accountability policy;
- procedures addressing auditable events;
- system security plan;
- system design documentation;
- system configuration settings and associated documentation;
- procedures addressing control of audit records;
- procedures addressing audit record generation;
- system audit logs and records;
- system auditable events;
- system incident reports;
- other relevant documents or records.
Who To Talk To
- Personnel with audit and accountability responsibilities;
- personnel with information security responsibilities;
- personnel with audit review, analysis and reporting responsibilities;
- system or network administrators.
Perform Test On
- Mechanisms implementing system audit logging.
Additional Information
It is important for companies to create audit records, protect the integrity of audit records and retain audit records. Good audit records will allow the company to monitor system activities, perform analysis on system activities, provide evidence for use during an investigation and reporting.
CMMC Practice Background and References (DOD, CMU) |
Practice Discussion:
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance.
Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures.
Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or failure indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred).
Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. NIST SP 800-92 provides guidance on security log management.
CMMC References:
· NIST SP 800-171 Rev 1 3.3.1
· CIS Controls v7.1 6.2
· NIST CSF v1.1. DE.CM-1, DE.CM-3, DE.CM-7
· CERT RMM v1.2 MON:SG2.SP3
· NIST SP 800-53 Rev 4 AU-2, AU-3, AU-3(1), AU-6, AU-11, AU-12