What this requirement asks
Review and update logged events.
This is a CMMC Level 2 requirement in the Audit & Accountability family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.3.3[a] — a process for determining when to review logged events is defined
- 3.3.3[b] — event types being logged are reviewed in accordance with the defined review process
- 3.3.3[c] — event types being logged are updated based on the review
What an assessor examines
Examine:
- Audit and accountability policy
- procedures addressing audit records and event types
- system security plan
- list of organization-defined event types to be logged
- reviewed and updated records of logged event types
- system audit logs and records
- system incident reports
- other relevant documents or records
Interview:
- Personnel with audit and accountability responsibilities
- personnel with information security responsibilities
Test:
- Mechanisms supporting review and update of logged event types
Evidence that defends it
Show documented review cadence and changes
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.