After you ask to examine some audit records, the contractor's system administrator informs you that there is a process to follow before accessing…

The contractor is not compliant with AU.L2-3.3.8. This CMMC practice requires the protection of both audit information and audit logging tools from unauthorized access, modification, and deletion. The scenario explicitly states two key findings that demonstrate non-compliance:

1. The contractor's access control policy has not defined the required protection measures for audit logging tools.

2. Employees can access all audit logging tools and "tweak the settings," which constitutes unauthorized access and modification, as such permissions should be restricted based on the principle of least privilege.

The presence of integrity checks (hashing) for audit records addresses a different control (e.g., AU.L2-3.3.4) but does not satisfy the requirement to protect the tools themselves.

A. The contractor's compliance cannot be determined based on the information provided

This is incorrect because the scenario provides direct evidence of non-compliance: a missing policy definition and overly permissive access for employees to modify audit tool settings.

B. The contractor is partially compliant, as audit logging tools are protected by the same measures as audit information

This is incorrect. The scenario describes protections for audit information (hashing, decryption) but explicitly states that the audit tools are not protected from unauthorized modification by employees.

C. The contractor is fully compliant; employees can access audit logging tools to meet their requirements

This is incorrect. Full compliance requires protection from unauthorized access. Allowing all employees to modify settings based on their "needs" violates the principle of least privilege and is a clear failure of access control.

---

1. U.S. Department of Defense (DoD), "CMMC Model Version 2.0," December 2021.

Reference: Page 33, Domain: Audit and Accountability (AU), Practice AU.L2-3.3.8.

Content: The practice is explicitly stated as "Protect audit information and audit logging tools from unauthorized access, modification, and deletion." The scenario demonstrates a direct failure to implement this for the audit logging tools.

2. National Institute of Standards and Technology (NIST), "Special Publication 800-171 Revision 2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," February 2020.

Reference: Page 21, Section 3.3, Requirement 3.3.8.

Content: This document, which forms the basis for CMMC Level 2, contains the identical requirement. The discussion section clarifies that "Unauthorized individuals could also disable or alter audit logging capabilities... to hide malicious activity," which is precisely the risk created by allowing employees to "tweak the settings."

3. National Institute of Standards and Technology (NIST), "Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations," September 2020.

Reference: Page 131, Control AU-9, "Protection of Audit Information."

Content: This control, which maps to NIST SP 800-171's 3.3.8, specifies that organizations must "Protect audit information and audit tools from unauthorized access, modification, and deletion." The control discussion emphasizes employing "access control mechanisms," which are clearly lacking in the scenario.