What this requirement asks
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
This is a CMMC Level 2 requirement in the Audit & Accountability family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (6)
- 3.3.1[a] — audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified
- 3.3.1[b] — the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined
- 3.3.1[c] — audit records are created (generated)
- 3.3.1[d] — audit records, once created, contain the defined content
- 3.3.1[e] — retention requirements for audit records are defined
- 3.3.1[f] — audit records are retained as defined
What an assessor examines
Examine:
- Audit and accountability policy
- procedures addressing auditable events
- system security plan
- system design documentation
- system configuration settings and associated documentation
- procedures addressing control of audit records
- procedures addressing audit record generation
- system audit logs and records
- system auditable events
- system incident reports
- other relevant documents or records
Interview:
- Personnel with audit and accountability responsibilities
- personnel with information security responsibilities
- personnel with audit review, analysis and reporting responsibilities
- system or network administrators
Test:
- Mechanisms implementing system audit logging
Evidence that defends it
Show event categories enabled; retention settings; sample logs
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.