Overview:
Limit management of audit functionality to a subset of privileged users.
Action Items:
3.3.9[a]
Determine if: a subset of privileged users granted access to manage audit logging functionality is defined.
3.3.9[b]
Determine if: management of audit logging functionality is limited to the defined subset of privileged users.
POTENTIAL ASSESSMENT METHODS AND OBJECTS
1
Examine: Audit and accountability policy; access control policy and procedures; procedures addressing protection of audit information; system security plan; system design documentation; system configuration settings and associated documentation; access authorizations; system-generated list of privileged users with access to management of audit logging functionality; access control list; system audit logs and records; other relevant documents or records].
2
Interview: Personnel with audit and accountability responsibilities; personnel with information security responsibilities; system or network administrators; system developers].
3
Test: Mechanisms managing access to audit logging functionality]
Related Documents (document name and content will vary by organization):
1) Audit and accountability policy
2) access control policy and procedures
3) procedures addressing protection of audit information
4) system security plan
5) system design documentation
6) system configuration settings and associated documentation
7) access authorizations
8) system-generated list of privileged users with access to management of audit logging functionality
9) access control list
10) system audit logs and records
11) other relevant documents or records
Additional Guidance:
Individuals with privileged access to a system and who are also the subject of an audit by that system, may affect the reliability of audit information by inhibiting audit logging activities or modifying audit records. This requirement specifies that privileged access be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges.
Article ID: 139
Created: September 26, 2022
Last Updated: September 27, 2022
Author: Matthew Burdick
Online URL: http://www.compliancewiki.org/article/nist-800-171-authorized-access-to-audit-functionality-3-3-9-139.html