CMMC L2 §3.3 AU-Family Controls, Satisfied by Construction — One Hash Chain, Three Regimes
The Problem CMMC Actually Creates for Data Platforms
CMMC L2 §3.3 is, at its core, an enforcement mechanism for NIST SP 800-171 / 800-53 controls — specifically the Audit & Accountability (AU) family. For any data platform that touches Controlled Unclassified Information (CUI), a C3PAO assessor will eventually ask the same five questions:
1. AU-2 — What events do you log?
2. AU-3 — What's *in* each audit record?
3. AU-9 — How is the audit log itself protected from modification?
4. AU-11 — How long do you keep it, and where?
5. AU-12 — Can the system silently stop logging?
Most data platforms answer these with a write-mostly log table, RBAC, and a backup policy. That answer survives a tabletop exercise. It does not survive a CMMC assessment, because *the platform itself* is the entity asked to prove that the audit record cannot have been quietly rewritten.
> Magellan AI is not itself CMMC-certified and is not a C3PAO. The product *produces the audit evidence* a CMMC assessor needs to verify the AU family.
What "Satisfies by Construction" Means
The Magellan Audit & Trust Ledger answers AU-9 the only way a software vendor honestly can: with a SHA-256 hash chain, not a policy. Each entry stores the hash of the previous entry. Tampering with any historical record invalidates every subsequent hash — and the verifier that detects this runs *outside* the Magellan runtime, on the exported evidence pack.
That choice — making integrity *mathematical* rather than *procedural* — is what lets one ledger satisfy three different regulatory regimes from the same artifact:
- HIPAA §164.312(b) — Audit controls
- 21 CFR Part 11 §11.10(e) — Secure, computer-generated, time-stamped audit trail
- CMMC L2 §3.3 AU-9 — Protection of Audit Information from modification
We call this "one pack, three regimes."
The AU-Family Crosswalk
| CMMC L2 §3.3 Control | What the assessor wants to see | How Magellan satisfies it |
|---|---|---|
| AU-2 Event Logging | A defined set of auditable events, captured every time | Every signed mapping decision (MappingDrafted, MappingRevised, ApproverReleaseSigned, SemanticSuggestionAccepted, RoleGranted, …) writes a ledger entry — non-optional |
| AU-3 Content of Audit Records | Who, what, when, where, source, outcome | ULID timestamp + actor + role-at-time-of-action + payload SHA-256 + prior-hash on every entry |
| AU-3(1) Additional info | Rationale + context | Model identifier, threshold profile version, confidence score on every Semantic Match suggestion |
| AU-6 Review & Reporting | Auditors can read; operators cannot rewrite | Dedicated magellan_auditor Postgres role with read-only ledger access, separate from app role |
| AU-7 Reduction & Reports | Deterministic export | Attestation export bundle + standalone Python verifier script (no Magellan runtime required) |
| AU-8 Time Stamps | Synchronized, embedded | 48-bit millisecond timestamp embedded in the ULID itself; chain-head signature time in WORM sink |
| AU-9 Protection from Modification | Tampering is detectable | Append-only enforcement (privilege revocation + trigger), SHA-256 hash chain, WORM Object Lock |
| AU-9(3) Cryptographic protection | Crypto, not policy | SSE-KMS on the WORM head; per-entry SHA-256 chain |
| AU-11 Retention | Per-program, configurable | RETENTION_POLICY per tenant; WORM Object Lock enforces minimum retention |
| AU-12 Audit Generation | Cannot be silenced | Container fails health check if audit writes are disabled |
Retention — Policy, Not Guesswork
CMMC L2 §3.3 AU-11 doesn't pick a single retention number. It defers to the program. That sounds flexible until you have HIPAA, Part 11, and CMMC sitting on the same dataset, each with a different floor.
Magellan resolves this with a single rule:
```
retention = max(
regulatory_floor(regime, data_classification),
customer_policy,
active_legal_hold
)
```
| Regime | Floor |
|---|---|
| HIPAA §164.530(j) / §164.316 | 6 years from creation or last effect |
| 21 CFR Part 11 / FDA records | Lifetime of product + 2 years |
| GxP / EU Annex 11 | Per registration — often 10–30 years |
| CMMC L2 §3.3 AU-11 | Per program (commonly 3 years); min. 90 days online |
| FedRAMP AU-11 | 3 years minimum, 1 year online |
| SOX §802 | 7 years for audit work papers |
Customer policy and legal holds can only extend retention, never shorten it. The chosen policy itself is written to the ledger as a RetentionPolicySet entry — so when an assessor asks "what was the retention rule in force on March 14, 2024?", the answer is in the chain, not in a Confluence page.
What This Means in a Procurement
For a federal or DIB integrator evaluating a metadata or mapping platform under a contract that touches CUI, the CMMC AU family normally turns into a 9-to-18-month risk-acceptance conversation. With Magellan, that conversation collapses into three artifacts:
1. The Audit & Trust Ledger (live)
2. The exported evidence pack for the dataset in question
3. The standalone verifier script the assessor runs themselves
Same artifacts a Part 11 inspector asks for. Same artifacts a HIPAA OCR auditor asks for.
That's what we mean when we say "one pack, three regimes."
See also: