AU.L2-3.3.4 Audit Failure Alerting

CMMC Requirement AU.L2-3.3.4 – Audit Failure Alerting: Alert in the event of an audit logging process failure.

Links to Publicly Available Resources

• Amazon Web Services – Operational Best Practices for CMMC 2.0 Level 2
  The following provides a sample mapping between the Cybersecurity Maturity Model Certification (CMMC) 2.0 Level 2 and AWS managed Config rules. Each Config rule applies to a specific AWS resource, and relates to one or more CMMC 2.0 Level 2 controls. A CMMC 2.0 Level 2 control can be related to multiple Config rules.

• CMMC Level 2 Assessment Guide
  This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.

• Environmental Protection Agency – Audit and Accountability Procedure
  This example procedure from the EPA shows how they implement the security control requirements for the Audit and Accountability (AU) control family, as identified in NIST SP 800-53.

• log.io – The Complete Guide to the ELK Stack
  This is an article from logz.io that speaks to defining the elk stack, the importance, installation and configuration of it.

• SANS – Critical Log Review Checklist For Security Incidents
  SANS checklist for reviewing critical logs when responding to a security incident or for routine log review.

• SolarWinds – Audit policies and best practices for SEM
  Best practices for Windows Auditing Log monitoring and different types of windows audit logs.

• YouTube – CMMC 2.0 Control AU.L2-3.3.4 – Alert in the Event of an Audit Logging Process Failure
  This video provides an in-depth explanation of alerting in the event of an audit logging process failure.

Discussion [NIST SP 800-171 R2]

Audit logging process failures include software and hardware errors, failures in the audit record capturing mechanisms, and audit record storage capacity being reached or exceeded. This requirement applies to each audit record data storage repository (i.e., distinct system component where audit records are stored), the total audit record storage capacity of organizations (i.e., all audit record data storage repositories combined), or both.

Further Discussion

Audit logging keeps track of activities occurring on the network, servers, user workstations, and other components of the overall system. These logs must always be available and functional. The company’s designated security personnel (e.g., system administrator and security officer) need to be aware when the audit log process fails or becomes unavailable [a]. Notifications (e.g., email, Short Message Service (SMS)) should be sent to the company’s designated security personnel to immediately take appropriate action. If security personnel are unaware of the audit logging process failure, then they will be unaware of any suspicious activity occurring at that time. Response to an audit logging process failure should account for the extent of the failure (e.g., a single component’s audit logging versus failure of the centralized logging solution), the risks involved in this loss of audit logging, and other factors (e.g., the possibility that an adversary could have caused the audit logging process failure).