CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.3.8Protect the logs themselves

Logs cannot be quietly edited or deleted by the people they record.

The requirement, verbatim

NIST SP 800-171 Rev. 2 · 3.3.8

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

Requirement 3.3.8, practice name in the CMMC assessment guide: Audit Protection.

NIST's discussion

Audit information includes all information (e.g., audit records, audit log settings, and audit reports) needed to successfully audit system activity. Audit logging tools are those programs and devices used to conduct audit and logging activities. This requirement focuses on the technical protection of audit information and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by media protection and physical and environmental protection requirements.

NIST SP 800-171 Rev. 2, discussion under 3.3.8. Whitespace normalised; wording unchanged.

Assessment objectives

An assessor decides each of these separately. The requirement is met only when every objective is.

  1. [a] audit information is protected from unauthorized access
  2. [b] audit information is protected from unauthorized modification
  3. [c] audit information is protected from unauthorized deletion
  4. [d] audit logging tools are protected from unauthorized access
  5. [e] audit logging tools are protected from unauthorized modification
  6. [f] audit logging tools are protected from unauthorized deletion

NIST SP 800-171A, determination statements for 3.3.8.

For assessors: examine, interview, test

NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.

Examine
  • Audit and accountability policy
  • procedures addressing protection of audit information
  • access control policy and procedures
  • system design documentation
  • system security plan
  • system configuration settings and associated documentation
  • system audit logs and records
  • audit record access reports
  • other relevant documents or records
Interview
  • Personnel with audit and accountability responsibilities
  • personnel with information security responsibilities
  • system or network administrators
  • system developers
Test
  • Mechanisms implementing audit information protection

NIST SP 800-171A, potential assessment methods and objects for 3.3.8.

Evidence

No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.

Scoring weight

Worth 1 point. Not meeting this requirement subtracts 1 from your 110-point SPRS score.

DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.

In Rev. 3

Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is reworded: 03.03.08 Protection of Audit Information.

See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.

Where this page's facts come from
Requirement text
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
Discussion
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
Practice name
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
Objectives
bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Examine, interview, test
bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
Level
bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
Weight
bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
Rev. 3 mapping
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Plain-language title and summary
editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)