What this requirement asks
Limit management of audit logging functionality to a subset of privileged users.
This is a CMMC Level 2 requirement in the Audit & Accountability family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.3.9[a] — a subset of privileged users granted access to manage audit logging functionality is defined
- 3.3.9[b] — management of audit logging functionality is limited to the defined subset of privileged users
What an assessor examines
Examine:
- Audit and accountability policy
- access control policy and procedures
- procedures addressing protection of audit information
- system security plan
- system design documentation
- system configuration settings and associated documentation
- access authorizations
- system-generated list of privileged users with access to management of audit logging functionality
- access control list
- system audit logs and records
- other relevant documents or records
Interview:
- Personnel with audit and accountability responsibilities
- personnel with information security responsibilities
- system or network administrators
- system developers
Test:
- Mechanisms managing access to audit logging functionality
Evidence that defends it
Show group membership and privileged role assignments
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.