Audit and Accountability 3.3.6 (3.3.6)
Provide audit record reduction and report generation to support on-demand analysis and reporting.
Get Full GuidanceWhat Is This CMMC Control?
This control requires organizations to have tools and processes that can filter, summarize, and generate reports from audit logs to support security analysis and investigations. Rather than manually reviewing thousands of raw log entries, organizations must be able to quickly search, filter, and create meaningful reports that help identify security incidents, anomalies, or compliance issues. This capability is essential for effective security monitoring and incident response.
Control Intent
Enable security personnel to efficiently analyze large volumes of audit data by providing tools that can filter, aggregate, and present audit information in meaningful formats that support timely security analysis, incident investigation, and compliance reporting.
Who This Control Applies To
- •Organizations that generate audit logs from systems processing CUI
- •Security Operations Centers (SOCs) or security teams responsible for log analysis
- •Systems administrators who monitor and investigate security events
- •Compliance teams that need to demonstrate audit review and analysis
- •Incident response teams that investigate security incidents using audit data
- •Any organization required to analyze audit logs for security or compliance purposes
Not Applicable When
- •The organization has no systems that generate audit logs (extremely rare)
- •All audit logs are generated by inherited cloud services and the organization has no access to or responsibility for log analysis (must be documented in inheritance agreements)
- •The organization has fewer than 5 systems and manually reviews all logs daily with documented evidence (rare and typically insufficient for Level 2)
Key Objectives
- 1Provide capabilities to reduce large volumes of audit records into manageable, meaningful summaries for analysis
- 2Enable generation of customizable reports from audit data to support security investigations and compliance requirements
- 3Support on-demand analysis of audit information to identify security incidents, anomalies, and trends
- 4Ensure audit data can be organized and presented in formats that facilitate timely decision-making and response
Sample Self-Assessment Questions (Partial)
Do you currently collect audit logs from your systems that process CUI?
What tools do you use to view, search, or analyze your audit logs?
Implementation Approaches (High-Level)
SIEM or Log Management Platform
Deploy a Security Information and Event Management (SIEM) system or centralized log management platform that aggregates logs from all CUI systems and provides search, filtering, correlation, and reporting capabilities.
Cloud-Native Logging with Enhanced Analysis Tools
Use cloud provider's native logging services (AWS CloudWatch, Azure Monitor, GCP Cloud Logging) enhanced with additional query and reporting tools to provide adequate reduction and report generation capabilities.
Hybrid Approach with Per-System Tools and Central Reporting
Use native logging and analysis tools on individual systems (Windows Event Viewer with filters, Linux log analysis tools, application-specific reporting) combined with a central repository or reporting system for cross-system analysis.
Managed Security Service Provider (MSSP) with Log Analysis
Contract with a Managed Security Service Provider that receives audit logs, performs analysis and reduction, and provides reports and on-demand investigation support.
Evidence & Assessment Notes
Expected Evidence
Organizations should maintain documentation and evidence demonstrating compliance with this control. This may include policy documentation, configuration records, audit logs, access reviews, and other relevant artifacts that show how the control is implemented and maintained.
Plan of Action & Milestones (POA&M)
If audit logs are collected but no analysis tools exist, prioritize implementing at least basic search and filtering capabilities - this is a fundamental gap For organizations with limited budgets, start with cloud-native logging tools or open-source solutions before considering expensive SIEM platforms If tools exist but aren't being used, focus on training and procedure development rather than new technology Consider phased implementation: basic search/filter first, then report generation, then advanced correlation and analysis Document interim manual processes if automated tools are not yet in place, but include timeline for automation If using MSSP, ensure contract modifications are included in POA&M timeline For time-ordering issues, address time synchronization (NTP) as part of remediation Include testing and validation of analysis capabilities in POA&M milestones Ensure POA&M addresses both technical capabilities and personnel training/procedures Consider starting with analysis of most critical systems first if implementing across large environment
Frequently Asked Questions
What's the difference between this control and 3.3.5 which requires audit review and analysis?
Control 3.3.5 requires that someone actually reviews and analyzes audit logs on a regular basis. Control 3.3.6 requires that you have the tools and capabilities to make that review and analysis practical and effective. You need both - the tools to analyze logs (3.3.6) and the process of actually doing it (3.3.5). Think of 3.3.6 as providing the 'how' and 3.3.5 as ensuring the 'what' gets done.
Do I need an expensive SIEM to satisfy this control?
No, you don't necessarily need an expensive SIEM. The control requires audit record reduction and report generation capabilities, which can be met through various means including cloud-native logging tools, open-source solutions, or even well-documented manual processes for small environments. However, the solution must actually provide meaningful search, filtering, and reporting capabilities - basic log viewing is typically insufficient.
Can I satisfy this control by manually reviewing raw log files?
Manual review of raw log files generally does not satisfy this control because it lacks the 'reduction and report generation' capabilities required. The control specifically requires tools or processes that can filter, summarize, and generate reports from audit data. For very small environments (typically fewer than 5 systems), documented manual processes with evidence of filtering and summarization might be acceptable, but this is rare for CMMC Level 2.
What types of reports should I be able to generate?
You should be able to generate reports that support security analysis and investigations, such as: summaries of failed login attempts, lists of configuration changes, access to specific CUI files or systems, privilege escalations, and user activity over time periods. The key is that reports must be customizable to support different investigation scenarios, not just fixed pre-built reports. The specific reports needed depend on your environment and security requirements.
If I use a cloud provider's logging service, does that automatically satisfy this control?
Not automatically. While cloud providers offer logging services, you must verify and document that their capabilities include adequate search, filtering, and report generation features. Basic log viewing interfaces typically don't meet the requirement. You may need to enable advanced query features (like CloudWatch Insights or Azure Log Analytics) or supplement with additional tools. You must also ensure your security personnel can actually access and use these capabilities on-demand.
How do I demonstrate 'on-demand' analysis capability during an assessment?
Assessors will typically ask you to demonstrate searching for specific events or generating a report during the assessment. You should be able to show how quickly you can find specific information (like all failed login attempts for a user) or generate a summary report without lengthy manual processes. Having documented procedures and trained personnel who can perform these tasks is essential. Evidence of recent analysis activities (within the last 90 days) also demonstrates on-demand capability.
How ConformatIQ Helps With CMMC Readiness
ConformatIQ is an AI-assisted CMMC readiness platform designed to help organizations prepare for assessments more efficiently. The platform supports document generation such as SSPs and POA&Ms, guided readiness workflows, centralized evidence tracking, and interview preparation for assessments.
Ready to Get Full Guidance?
Access complete implementation details, detailed assessment questions, evidence requirements, and expert guidance for this control.
Request Full GuidanceInformation sourced from NIST SP 800-171 Rev. 2. See full disclaimer.