AU.2.008 — Protect Audit Information and Tools from Unauthorized Access

What AU.2.008 means in plain English

Your audit logs are only useful as evidence if someone cannot tamper with them. An attacker who gets into your system will try to delete the logs that prove they were there. You need to store logs somewhere that standard user accounts—and even most admin accounts—cannot delete or modify. This means restricting who can clear the Windows Security log, setting NTFS permissions on archived log files, and making sure M365 audit logs cannot be turned off without an alert being triggered. For extra protection, consider sending logs to a separate system where they cannot be edited.

The assessment question

“Are audit logs and audit tools protected from unauthorized modification or deletion through access controls and permissions, with evidence that only authorized personnel can manage audit settings?”

How to implement AU.2.008

1. Restrict who can clear Windows Security logs: in Group Policy navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > "Manage auditing and security log." Ensure only the designated IT administrator account is listed here—remove standard users.
2. Protect archived log files with NTFS permissions: navigate to the archive folder (e.g., \\server\CMMC-Evidence\AuditLogs), right-click > Properties > Security. Grant Read access to your IT admin account only. Remove write/delete permissions for standard users. Enable auditing on the folder itself so any access is logged.
3. For Microsoft 365: assign the Audit Reader role only to individuals who need to review logs (compliance.microsoft.com > Roles). Use Privileged Identity Management (PIM) if on E5 to require justification for elevated access.
4. Consider forwarding Windows event logs to a Wazuh SIEM instance on a separate machine with its own credentials. Once logs are forwarded, they are protected even if the source machine is compromised.
5. Document the access control configuration in a one-page "Audit Log Protection Summary": who has access, what access level, and how it was configured. Store screenshots of the NTFS permissions and Group Policy settings as evidence.

Evidence your assessor will ask for

• Group Policy configuration showing only authorized accounts have "Manage auditing and security log" right
• NTFS permissions screenshot for the audit log archive folder showing restricted access
• Microsoft 365 role assignments showing only designated personnel have Audit Reader/Manager roles
• Written "Audit Log Protection Summary" documenting the access control design
• Evidence of regular review that log permissions have not been changed

More Audit & Accountability controls