Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Audit and accountability policy, access control policy and procedures addressing the protection of audit information that is documented and available upon request.   

·  System generated list of privileged users with access to the management of the audit capability.

·  Accounts dedicated for audit functions and evidence of their utilization, to verify that privileged access is not included into an account that is also used for typical system user functionality.   Accordingly, those individuals with audit management functionality should also have a user account and a separate account for audit management.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

Policy and operational procedures to determine if the organization capture audit records, protect the integrity of the audit collection process, and that retention requirements for audit records is defined. 

Evidence of the content in audit logs (event types) and audit records.

Audit collection process to determine that access to the audit logs are restricted from unauthorized access.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

Policy and procedures related to Audit and Accountability that identifies the type of individual informaiton system user actions that can be monitored .

Evidence the company monitors the actions of individual system users pursuant to the policy above.

Evidence or system observations that demonstrate an ability to trace unauthroized system user activity.

Implementation of non-repudiation services such as digital signatures or digital message receipts.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Organization-defined event types logged and information system audit records to determine that logged events are reviewed and updated based on the review, which may be necessary to ensure what is logged is sufficient.

·  Demonstration of system event logs to identify any log consolidation systems or capabilities that are implemented, and review reports where system logs capture event data based on alerts or suspicious activity.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Demonstration that alerting for an audit failure works as intended and if the company maintains a list of personnel to be notified in the case of an audit processing failure. 

·  List of personnel that receive audit processing failure notifications, such as system administrators or security personnel with evidence personnel on list are receiving the alerts.

·  Information system configuration settings and a demonstration to ensure the system can log audit processing failures and relevant events. 

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Automated mechanisms that integrate the audit review, analysis, and reporting processes. 

·  List of employees with audit review, analysis and reporting responsibilities.

·  Company procedures that address investigation and response to suspicious activities and information system audit records from across different repositories.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Your company's ability to collect audit information and organizes such information in summary format.  

·  Your system's ability to support on-demand analysis and reporting including for evidence of its use in supporting after-the-fact security investigations.

·  Your system's audit reduction and report generation capability including any use of data mining techniques with automated capabilities to identify anomalous behavior in audit records.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·   Procedures or processes that address maintaining synchronized internal system time clocks that typically are linked to an authoritative time source. 

·   Supporting documentation that define identification and connectivity with the authoritative time source, and the frequency of the time synchronicity.

This practice support audit event and audit record time stamps that may be needed for post investigation or troubleshooting activities.  

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Audit and accountability policy and procedures to ensure that only authorized personnel have access to audit information, centralized collection systems, and supporting capabilities. 

·  Organizational procedures addressing the protection of audit information.