Control 3.3.9

★What This Means in Plain English

Only a small number of specifically authorized individuals should be able to configure, modify, or manage the audit logging system. This prevents insiders from disabling logging to cover malicious activity.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Arctic Wolf SIEM administrative access restricted to designated security personnel only
• Role-based access in the SIEM platform separating viewers from administrators
• Audit of SIEM administrative actions logged and reviewed by a separate security reviewer
• ComplianceArmor documenting the list of personnel authorized to manage audit logging
• Multi-factor authentication required for all SIEM administrative access

🔎Assessment Guidance

Assessors will review the list of personnel with audit logging management access, verify that access is appropriately restricted, test that non-authorized users cannot modify logging configurations, and confirm that changes to logging are themselves audited.

⚠Common Implementation Gaps

• All IT staff having admin access to the SIEM or logging infrastructure
• No role separation within the logging management system
• Changes to logging configuration not audited
• No documented list of authorized logging administrators
• Logging management accessible without MFA

⇄Cross-Framework Mapping