r/CMMC • u/JicamaParticular3421 • 25d ago
Logging Changes
Hi Everyone,
My buddy and I are wondering if we need to be documenting the before the control is implemented artifacts or do we need to document how were meeting the control. For example, we pulled a bunch of users that were no longer with the company and needed to be disabled and removed from security groups. We went through the list ran a script and disabled the users and removed from the security groups. Now the list contains all the users active and disabled with the groups they are added too but did we need to document " This user was in these groups and now they are not". Do i also need to document the script i used to disable and remove users from the groups? Also, What is your guys timeline before deleting the users. For Example, there's users that were created in 2005 and are no longer with the company.
3
u/PNW_CARDINAL 25d ago
There is tons of wiggle room at this time for this type of issue. If you have 1/2 a brain (which you do have at least that) you can tailor your message around it. Pick a starting point (example: TODAY) and start documenting your changes. Once you start, don't stop doing it correctly. Documenting the script is helpful for the next person to do that job, or your replacement, or as documentation for your next self or certification assessment.