AU.2.009 — Limit Audit Log Management to Privileged Users

What AU.2.009 means in plain English

Only the person specifically responsible for IT security should be able to change what gets logged, clear logs, or adjust audit settings. Not every person with an admin account should have this power—in fact, in a small shop you should have only one person (or at most two, for backup) who can touch audit configuration. This prevents an insider threat scenario where someone disables logging before doing something they should not. This control overlaps with AU.2.008 but focuses on limiting who can change the logging configuration itself rather than just who can read logs.

The assessment question

“Is the ability to modify audit logging configuration restricted to a named subset of privileged users, documented by policy and enforced by technical controls?”

How to implement AU.2.009

1. Create a dedicated "Audit Administrator" role or use an existing minimal-privilege admin account. This account—not the general IT admin account used for daily tasks—should be the only account with rights to modify audit policy.
2. In Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment), ensure only the designated Audit Administrator account appears in "Manage auditing and security log." Document the account name and the person responsible.
3. For Microsoft 365, assign the "Audit Manager" or "Compliance Administrator" role only to the designated individual. Audit this role assignment quarterly to ensure it has not been expanded.
4. Write a one-paragraph policy addendum specifying: "Only [Name/Role] is authorized to modify audit logging settings, clear audit logs, or change log retention configuration. Any such change must be documented in the Change Management Log with justification and date."
5. Enable monitoring of audit policy changes: Event ID 4719 (System audit policy was changed) and 4817 (Auditing settings on object were changed) will fire in Windows if audit settings are modified. Ensure these events are themselves captured in your logs.

Evidence your assessor will ask for

• Group Policy configuration showing only one or two named accounts have audit management rights
• Microsoft 365 role assignment showing the Audit Manager role is limited to named individuals
• Written policy naming who is authorized to manage audit logging
• Change log entry for any time audit settings were modified, showing justification and approver
• Evidence that Event ID 4719 is being captured (screenshot of the event in logs)

More Audit & Accountability controls