Mapped to NIST 800-171 Requirement: 3.3.1
CMMC Assessment Objective: AU.L2-3.3.1[a]
What This Objective Means
Before you can decide what should be logged, you need to know what can be logged. This means evaluating:
• Your endpoints (e.g., Windows, Linux systems)
• Firewalls and network gear
• Security tools (e.g., antivirus, endpoint detection and response)
• Applications and cloud services
The goal is to understand the full range of available event types, such as:
• Logon/logoff attempts
• File access or modification
• Administrative actions
• Account creation or privilege changes
• System startup or shutdown
This evaluation process is a critical part of establishing an effective information security risk framework.
Why It Matters
Without identifying what your systems are capable of logging:
• You may miss critical security events
• You might overload systems by logging irrelevant data
• You won’t know what coverage gaps you have
This objective lays the groundwork for informed audit logging decisions, which are integral to any robust cybersecurity risk management framework.
How to Implement It
• Review logging capabilities across:
◦ Operating systems
◦ Firewalls and IDS/IPS systems
◦ Applications that store or process CUI
◦ Cloud and SaaS platforms
• Document supported event types per system or category
• Use vendor documentation or platform-specific logging guides
• Store this capability inventory in your System Security Plan (SSP) or audit log policy
Evidence the Assessor Will Look For
• A list of event types that can be logged by your systems
• Documentation or diagrams showing which systems support which logging features
• Screenshots of logging configurations or sample logs
• Internal review or gap analysis of current vs. potential logging capabilities
Common Gaps
• Logging is enabled, but the organization doesn’t know what’s being captured
• Logging capabilities differ across systems with no standardization
• Logging coverage is assumed, not documented
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Defining and documenting the types of events the Cuick Trac platform logs by default
• Helping organizations evaluate logging capabilities across supporting systems
• Offering templates for log source mapping and coverage analysis
• Providing a centralized, controlled environment where loggable actions are predefined
With Cuick Trac, you know exactly what’s being logged—and what your systems are capable of capturing, aligning with security compliance frameworks and enhancing your information security risk framework.
Final CTA
You can’t secure what you don’t track—and you can’t track what you don’t understand.
Schedule a Cuick Trac demo and get visibility into your audit logging foundation.