Guide

NIST SP 800-53 AU-9: Immutable Audit Logs and Protection

NIST SP 800-53 Revision 5 control AU-9 (Protection of Audit Information) requires organizations to protect audit information and audit tools from unauthorized access, modification, and deletion, including by privileged administrators. The threat is documented, not hypothetical: CISA joint advisories confirm that Play, Hive, and Ghost ransomware actors actively delete logs to hide intrusion activity, and nation-state actors go further, disabling admin accounts and clearing Windows Event Logs from critical servers before exfiltrating data.

Key takeaways

AU-9 governs what happens to logs after they exist; AU-2 and AU-12 govern what gets logged and how records are generated
A log that can be modified or deleted by the accounts or systems it monitors provides no reliable accountability
Six optional enhancements add hardware write-once storage, cryptographic protection, and dual authorization
Separate log storage from audited systems so a compromised host cannot alter or destroy its own records
Federal, healthcare, and financial organizations treat AU-9 as non-negotiable, with enhancements increasingly required for high-impact and AI systems

What does AU-9 require?

The base control: audit information and audit tools protected from unauthorized access, modification, and deletion, treated as a security objective in its own right. AU-9 coordinates with its AU-family neighbors: AU-11 (retention duration), AU-10 (non-repudiation, individuals cannot deny actions), and AU-3 (record content). AU-9 is the link that makes the rest of the family trustworthy: retention of records an attacker could rewrite is theater.

What are the AU-9 control enhancements?

(1) Hardware-enforced write-once media for log storage; (2) storage of audit records on separate systems or components from the system being audited; (3) cryptographic protection of audit information integrity; (4) access restricted to a defined subset of privileged users; (5) dual authorization for movement or deletion of audit information; (6) read-only access enforcement. Selection follows impact level, high-impact systems, and increasingly AI systems whose records carry regulatory weight, justify the stronger set.

How do you implement AU-9-compliant immutable logging?

Centralize logs off the audited systems immediately on generation; apply write-once or append-only storage with cryptographic integrity (hash chains or signatures); scope access narrowly and separately from system administration; require dual authorization for any retention-policy change; and monitor the logging pipeline itself, gaps in log flow are an incident signal, not an inconvenience.

Where does AU-9 apply, and what about AI systems?

Directly: federal systems and contractors under FISMA/FedRAMP baselines. By inheritance: healthcare and financial organizations whose frameworks (HITRUST, examiner expectations) draw on 800-53. And increasingly: AI systems, whose audit trails are both compliance evidence (EU AI Act logging obligations, HIPAA activity review) and attack targets. Trussed AI generates AI interaction records designed for this standard, complete, tamper-resistant, stored independently of the applications they document, and produced automatically as a byproduct of governed traffic.

Frequently Asked Questions

Does AU-9 require blockchain or special hardware? No, append-only storage with cryptographic integrity and separation from audited systems satisfies the base control; hardware write-once is an enhancement for higher baselines.

Who should be able to delete logs? Under the dual-authorization enhancement: no single person. At minimum, log deletion rights must be separated from the admin rights of monitored systems.

How does AU-9 apply to AI audit trails specifically? AI decision records are exactly the class of evidence attackers and bad actors want altered, protect them with the same separation, integrity, and access discipline as security logs.

Related resources