AU.L2-3.3.1
System Auditing
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AU.L2-3.3.1 in the reference catalog with its NIST cross-references
Official requirement
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Assessment objectives
a. audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified;
b. the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined;
c. audit records are created (generated);
d. audit records, once created, contain the defined content;
e. retention requirements for audit records are defined; and
f. audit records are retained as defined.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Create and retain audit records sufficient to investigate and report inappropriate system activity.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You set up audit logging capability for your company. You determine that all systems that contain CUI must have extra detail in the audit logs . Because of this, you configure thes e systems to log the following information for all user actions [b,c]: • time stamps; • source and destination addresses; • user or process identifiers; • event descriptions; • success or fail indications; and • filenames.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Audit and accountability policy; procedures addressing auditable events; system security plan; system design documentation; system configuration settings and associated documentation; procedures addressing control of audit records; procedures addressing audit record generation; system audit logs and records; system auditable events; system incident reports; other relevant documents or records
Common mistakes
Collecting logs without defining needed events, record content, and retention.