AU.L2-3.3.1 System auditing
Creating and retaining audit logs with enough content to monitor, analyze, investigate and report unlawful or unauthorized activity: which events to log, what each record must contain, and how long to keep it.
AU Audit and accountability
The nine CMMC Level 2 audit and accountability requirements: creating and retaining audit logs, tracing actions to users, reviewing and correlating events, alerting on logging failures, time stamps, and protecting audit data.
AU.L2-3.3.2 User accountability
Making sure the actions of each individual user can be traced uniquely to that user through audit record content such as user IDs, addresses and time stamps, so users can be held accountable.
AU.L2-3.3.3 Event review
Reviewing and updating which event types are logged, on a defined schedule or trigger. This requirement concerns the logging configuration itself; reviewing the resulting audit records falls under AU.L2-3.3.5 and AU.L2-3.3.6.
AU.L2-3.3.4 Audit failure alerting
Alerting designated people when an audit logging process fails, so gaps in logging are noticed and fixed. Covers defining failure types and recipients, alert mechanisms and evidence of alerts.
AU.L2-3.3.5 Audit correlation
Correlating audit record review, analysis and reporting across repositories to investigate and respond to unlawful, unauthorized, suspicious or unusual activity. A 5-point requirement often met with centralized logging or a SIEM.
AU.L2-3.3.6 Reduction and reporting
Providing audit record reduction and report generation so logs can be filtered and summarized on demand without altering the originals. Covers reduction and reporting tools and how assessors test them.
AU.L2-3.3.7 Authoritative time source
Synchronizing internal system clocks with a specified authoritative time source so audit record time stamps are consistent across systems. Covers time server configuration and evidence.
AU.L2-3.3.8 Audit protection
Protecting audit information and audit logging tools from unauthorized access, modification and deletion, limiting access to people with a need to know. Covers log storage protections, tool permissions and evidence.
AU.L2-3.3.9 Audit management
Limiting management of audit logging functionality to a defined subset of privileged users, kept separate from other administrative duties so misuse by privileged users is not hidden.
