AU.L2-3.3.5
Audit Correlation
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AU.L2-3.3.5 in the reference catalog with its NIST cross-references
Official requirement
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
Assessment objectives
a. audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined; and
b. defined audit record review, analysis, and reporting processes are correlated.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Correlate audit review, analysis, and reporting to help identify suspicious activity.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a member of a cyber defense team responsible for audit log analysis. You run an automated tool that analyzes all the audit logs across a Local Area Network (LAN) segment simultaneously looking for similar anomalies on separate systems at separate locations. Some of these systems store CUI. After extracting anomalous information and performing a correlation analysis [b], you determine that four different systems have had their event log information cleared between 2:00 AM to 3:00 AM, although the associated dates are different. The team monitors all systems on the same LAN segment between 2:00 AM to 3:00 AM for the next 30 days.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Audit and accountability policy; procedures addressing audit record review, analysis, and reporting; system security plan; system design documentation; system configuration settings and associated documentation; procedures addressing investigation of and response to suspicious activities; system audit logs and records across different repositories; other relevant documents or records
Common mistakes
Reviewing individual log sources in isolation and missing related events.