Audit and Accountability (AU)

CMMC Audit and Accountability (AU) Requirements

Audit and Accountability contains 9 CMMC Level 2 requirements focused on logging system activity and maintaining records. These controls ensure you can answer a critical question after any security incident: “What happened?”

Audit and Accountability means creating, protecting, and reviewing records of system activity to track user actions and detect security events.

Without audit logs, you cannot investigate incidents, prove compliance, or hold individuals accountable for their actions. Logging is your security camera system for the digital world.

Why Audit and Accountability Matters for CMMC

The Department of Defense requires Audit and Accountability because protecting Controlled Unclassified Information (CUI) requires knowing who accessed it and what they did with it.

CUI stands for Controlled Unclassified Information—sensitive government data requiring protection but not classified as secret.

Audit logs serve multiple purposes:

• Incident Investigation: Determine what happened during a security event
• Threat Detection: Identify suspicious activity before it becomes a breach
• Compliance Evidence: Prove your security controls are working
• Accountability: Track individual user actions
• Forensics: Support legal proceedings if needed

The 9 Audit and Accountability Requirements

AU.L2-3.3.1: System Auditing

“Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.”

This foundational requirement establishes that you must have logging in place. Your systems need to record activity in enough detail to investigate problems.

AU.L2-3.3.2: User Accountability

“Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.”

This requirement connects to Access Control—each person needs a unique account so their actions can be attributed to them specifically. Shared accounts break accountability.

AU.L2-3.3.3: Event Review

“Review and update logged events.”

You cannot just collect logs and ignore them. This requirement means periodically reviewing what events you log to ensure you capture necessary information and adjusting as your environment changes.

AU.L2-3.3.4: Audit Failure Alerting

“Alert in the event of an audit logging process failure.”

If logging stops working, you need to know immediately. Attackers sometimes disable logging to hide their activities. This control ensures logging failures trigger alerts.

AU.L2-3.3.5: Audit Review and Analysis

“Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.”

This requirement goes beyond collecting logs to actually analyzing them. You need processes to review logs, identify suspicious patterns, and investigate anomalies.

AU.L2-3.3.6: Audit Reduction and Report Generation

“Provide audit record reduction and report generation to support on-demand analysis and reporting.”

Raw logs are often overwhelming. This control requires tools or processes to filter, summarize, and report on log data so you can find relevant information when needed.

AU.L2-3.3.7: Authoritative Time Source

“Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.”

All your systems need synchronized clocks using a reliable time source (like NTP servers). Without accurate timestamps, logs from different systems cannot be correlated during investigations.

NTP stands for Network Time Protocol—the standard method for synchronizing computer clocks over a network.

AU.L2-3.3.8: Audit Protection

“Protect audit information and audit logging tools from unauthorized access, modification, and deletion.”

Logs must be protected from tampering. If attackers can modify or delete logs, they can hide their activities. Restrict who can access or modify audit data.

AU.L2-3.3.9: Audit Management Limitation

“Limit management of audit logging functionality to a subset of privileged users.”

Only specific administrators should be able to configure logging settings. Regular users should not be able to disable logging or modify what gets recorded.

What Events to Log

At minimum, log these events on systems handling CUI:

Authentication Events

• Successful and failed login attempts
• Account lockouts
• Password changes
• Multi-factor authentication events

Authorization Events

• Access to sensitive files and folders
• Privilege escalation attempts
• Permission changes

System Events

• System startup and shutdown
• Service starts and stops
• Security software status changes
• Configuration changes

Administrative Actions

• User account creation, modification, deletion
• Group membership changes
• Security policy changes
• Software installation

Log Retention

CMMC does not specify exact retention periods, but DoD contracts often require retaining logs for at least one year, with three years recommended. Check your specific contract requirements.

Store logs in a location separate from the systems being monitored. If an attacker compromises a system, locally stored logs may be deleted or modified.

Implementing Audit and Accountability

Enable Native Logging

Most systems have built-in logging capabilities:

• Windows: Enable Windows Security Event logging, configure audit policies
• Linux: Configure syslog, auditd, and application logging
• Network Devices: Enable logging on firewalls, routers, switches
• Applications: Enable logging in databases, file servers, email systems

Centralize Log Collection

Send logs from all systems to a central location:

• Security Information and Event Management (SIEM) solutions
• Log management platforms
• Cloud-based logging services

SIEM stands for Security Information and Event Management—software that collects, stores, and analyzes logs from multiple sources.

Centralized logging protects logs from local tampering and enables correlation across systems.

Establish Review Processes

Create procedures for log review:

• Automated alerts for critical events (failed logins, privilege escalation)
• Daily review of security-relevant events
• Weekly summary reports
• Investigation procedures for anomalies

Protect Log Integrity

Implement controls to prevent log tampering:

• Restrict access to log files and logging configuration
• Send logs to write-once storage or separate systems
• Use integrity monitoring to detect log modifications

Common Audit and Accountability Mistakes

Mistake 1: Logging Everything or Nothing

Logging every possible event creates noise that hides important information. Logging nothing leaves you blind. Find the balance—log security-relevant events.

Mistake 2: Collecting Without Reviewing

Logs only have value if someone looks at them. Establish regular review processes and automated alerting.

Mistake 3: Local-Only Storage

Storing logs only on the systems generating them makes logs vulnerable to deletion during attacks. Centralize log storage.

Mistake 4: Unsynchronized Clocks

Without accurate, synchronized timestamps, you cannot correlate events across systems. Configure NTP on all systems.

Key Takeaways

Audit and Accountability’s 9 requirements establish logging as a security fundamental. Create logs, protect them from tampering, and actually review them for suspicious activity.

Focus on logging authentication, authorization, system events, and administrative actions. Centralize logs, synchronize time across systems, and establish review processes. These controls provide the visibility needed to detect and investigate security incidents.

---

Related Articles:

• What is CMMC Level 2?
• CMMC Level 2 Security Controls Overview
• NIST SP 800-171 Rev 2 – Audit and Accountability Family
• 32 CFR Part 170 – CMMC Program Rule
• CMMC Level 2 Assessment Guide

Official Sources: This article is based on NIST SP 800-171 Revision 2 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,” specifically the Audit and Accountability family (Section 3.3), and the DoD CMMC Level 2 Assessment Guide.

---

Need help implementing logging for CMMC compliance? Contact Greypike for expert guidance on Level 1 and Level 2 certification, or get started with Obolix to streamline your compliance journey.