diff --git a/tasks/section_6/cis_6.2.4.1.yml b/tasks/section_6/cis_6.2.4.1.yml
index 814c46c..9e8b9b3 100644
--- a/tasks/section_6/cis_6.2.4.1.yml
+++ b/tasks/section_6/cis_6.2.4.1.yml
@@ -8,6 +8,8 @@
     - patch
     - logfiles
     - rule_6.2.4.1
+    - NIST800-53R5_AC-3
+    - NIST800-53R5_MP-2
   block:
     - name: "6.2.4.1 | AUDIT | Ensure access to all logfiles has been configured | find log files"
       ansible.builtin.shell: find /var/log/ -type f -exec ls {} \;
@@ -15,43 +17,35 @@
       failed_when: false
       register: discovered_logfiles
 
-    - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
+    - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions SSSD min 660"
       when:
         - discovered_logfiles.stdout_lines | length > 0
-        - ('audit.log' in item or 'journal' in item) or
-          item == '/var/log/secure' or
-          item == '/var/log/syslog' or
-          item == '/var/log/messages' or
-          item == '/var/log/auth.log'
+        - item is match("/var/log/(gdm|sssd)")
       ansible.builtin.file:
         path: "{{ item }}"
-        mode: 'u-x,g-wx,o-rwx'
+        mode: 'ug-x,o-rwx'
       failed_when: discovered_logfile_list.state not in '[ file, absent ]'
       register: discovered_logfile_list
       loop: "{{ discovered_logfiles.stdout_lines }}"
 
-    - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
+    - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions tmp min 664"
       when:
         - discovered_logfiles.stdout_lines | length > 0
-        - ('anaconda' in item or 'dnf' in item or 'secure' in item  or 'messages' in item or 'hawkey' in item)
-      ansible.builtin.file:
-        path: "{{ item }}"
-        mode: 'u-x,g-x,o-rwx'
-      failed_when: discovered_logfile_list.state not in '[ file, absent ]'
-      register: discovered_logfile_list
-      loop: "{{ discovered_logfiles.stdout_lines }}"
-
-    - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
-      when:
-        - discovered_logfiles.stdout_lines | length > 0
-        - ('sssd' in item or 'lastlog' in item) or
-          item == "/var/log/btmp" or
-          item == "/var/log/utmp" or
-          item == "/var/log/wtmp" or
-          item == "/var/log/lastlog"
+        - item is match("/var/log/((u|b|w)tmp*|lastlog)")
       ansible.builtin.file:
         path: "{{ item }}"
         mode: 'ug-x,o-wx'
       failed_when: discovered_logfile_list.state not in '[ file, absent ]'
       register: discovered_logfile_list
       loop: "{{ discovered_logfiles.stdout_lines }}"
+
+    - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions else all 640"
+      when:
+        - discovered_logfiles.stdout_lines | length > 0
+        - item is not match("/var/log/((u|b|w)tmp*|lastlog|sssd)")
+      ansible.builtin.file:
+        path: "{{ item }}"
+        mode: 'u-x,g-wx,o-rwx'
+      failed_when: discovered_logfile_list.state not in '[ file, absent ]'
+      register: discovered_logfile_list
+      loop: "{{ discovered_logfiles.stdout_lines }}"