Meet CMMC logging requirements with audit evidence for every session.
The AU domain in CMMC Level 2 covers nine NIST 800-171 controls. A common gap: logs exist, but nobody can prove they are tamper-evident, retained, or tied to a named user. This page maps each AU control to the evidence Access Gate produces.
Last updated:
Why CMMC logging often falls short at audit.
A SIEM that ingests firewall syslog is not enough. The AU domain requires per-user, per-session, tamper-evident records that survive forensic review. Access Gate logs every session at the proxy with user identity, timestamp, asset, protocol and full session replay. Hash chaining and FIPS-validated signing make the logs tamper-evident. Retention defaults to 90 days on-premise, and you can export to your SIEM or air-gapped storage.
AU.L2-3.3.1 to 3.3.9, mapped to evidence.
Each control below lists what CMMC requires, the evidence Access Gate produces, and the artifact your C3PAO will review.
Create and retain system audit logs and records to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Access Gate logs every proxied session with user, timestamp, source/destination, protocol, and full session payload (when enabled). Logs are written to an append-only store with hash chaining; tampering breaks the chain and is flagged on read.
Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Every session is bound to an authenticated identity at the proxy boundary. Service accounts and shared credentials are blocked by policy. The audit record names the human user who initiated the session, even when the underlying asset uses a shared credential.
Review and update logged events.
Access Gate's logged event taxonomy is policy-driven and version-controlled. Updates ship with each release with a documented changelog suitable for inclusion in your SSP.
Alert in the event of an audit logging process failure.
Access Gate self-monitors the log pipeline. Failure to write to the store, exhaustion of disk space, or loss of connection to a forwarded SIEM all generate immediate alerts via syslog, webhook, or email.
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
Access Gate exports normalized, structured logs (CEF, JSON, syslog) suitable for SIEM correlation. Built-in dashboards group sessions by user, asset, and time window for in-tool review when no external SIEM is deployed.
Provide audit record reduction and report generation to support on-demand analysis and reporting.
Access Gate generates pre-built C3PAO evidence packages on demand: per-user activity reports, per-asset access histories, and policy-violation summaries. Output formats are CSV, PDF, and structured JSON.
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
Access Gate runs NTP synchronization against operator-configured time sources by default. Time drift exceeding policy thresholds is logged and alerted.
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
Audit storage is segregated from operational data and access-controlled by RBAC. Hash-chained records prevent silent modification. Logs can be FIPS-signed and forwarded to write-once storage for jurisdictions that require it.
Limit management of audit logging functionality to a subset of privileged users.
Audit configuration is gated behind a dedicated 'audit-admin' role distinct from system administration. Changes to audit policy themselves generate audit records, providing accountability for the auditors.
See your AU domain evidence in 30 minutes.
Request a working session with our compliance team. We will show the audit packages we have generated for current customers preparing for C3PAO assessment.
Request a demo