AU-9 says:

The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

We should make sure that the directories that store the apiserver audit logs (/var/log/kube-apiserver, /var/log/openshift-apiserver, /var/log/oauth-apiserver) have the correct permissions and ownership