AU.L2-3.3.3
Event Review
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AU.L2-3.3.3 in the reference catalog with its NIST cross-references
Official requirement
Review and update logged events.
Assessment objectives
a. a process for determining when to review logged events is defined;
b. event types being logged are reviewed in accordance with the defined review process; and
c. event types being logged are updated based on the review.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Review and update the events your systems log.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of IT operations for a company that processes CUI and are responsible for identifying and documenting which events are relevant to the security of your company’s systems. Your company has decided that this list of events should be updated annually or when new security threats or events have been identified, which may require additional events to be logged and reviewed [a]. The list of events you are capturing in your logs started as the list of recommended events given by the manufacturers of your operating systems and devices, but it has grown from experience. Your company experiences a security incident, and a forensics review shows the logs appear to have been deleted by a remote user . You notice that remote sessions are not currently being logged [b]. You update the list of events to include logging all VPN sessions [c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Audit and accountability policy; procedures addressing audit records and event types; system security plan; list of organization- defined event types to be logged; reviewed and updated records of logged event types; system audit logs and records; system incident reports; other relevant documents or records
Common mistakes
Keeping the original logging configuration indefinitely despite changing risks and systems.