AU.L2-3.3.2
User Accountability
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AU.L2-3.3.2 in the reference catalog with its NIST cross-references
Official requirement
Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Assessment objectives
a. the content of the audit records needed to support the ability to uniquely trace users to their actions is defined; and
b. audit records, once created, contain the defined content.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Make individual users' actions traceable to those users.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Y ou manage systems for a company that stores, processes, and transmits CUI. You want to ensure that you can trace all remote access sessions to a specific user. You configure the VPN device to capture the following information for all remote access connections : source and destination IP address, user ID, machine name, time stamp, and user actions during the remote session [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Audit and accountability policy; procedures addressing audit records and event types; system security plan; system design documentation; system configuration settings and associated documentation; procedures addressing audit record generation; procedures addressing audit review, analysis, and reporting; reports of audit findings; system audit logs and records; system events; system incident reports; other relevant documents or records
Common mistakes
Relying on shared accounts that erase individual accountability.