Mapped to NIST 800-171 Requirement: 3.3.1
CMMC Assessment Objective: AU.L2-3.3.1[b]
What This Objective Means
After understanding what your systems can log (AU.L2-3.3.1[a]), this objective focuses on selecting what your organization must log to meet CUI protection and auditability goals. You need to define required event types such as:
• User logon/logoff
• Failed login attempts
• Privilege escalation or changes
• File or database access to CUI
• Configuration changes
• Use of administrative accounts
• Remote access events
The selected event types must be relevant to your security monitoring, incident response, and compliance requirements.
Why It Matters
If you’re not logging the right events:
• You may miss indicators of compromise or insider misuse
• Incident investigations could lack key information
• You won’t be able to demonstrate compliance during assessments
Knowing what must be logged ensures you focus resources on security-relevant events.
How to Implement It
• Review regulatory requirements (e.g., NIST 800-171, DFARS) and align them with system capabilities
• Consult NIST SP 800-92 and NIST SP 800-53 (AU family) for logging best practices
• Identify mandatory log events for:
◦ Workstations
◦ Servers
◦ Applications
◦ Firewalls and network devices
• Document required event types in your:
◦ Audit and Accountability Policy
◦ System Security Plan (SSP)
◦ Logging configuration documentation
Evidence the Assessor Will Look For
• A documented list of required event types for logging
• Policies or procedures specifying what must be logged
• Mapping between system types and required events
• Justification or rationale for chosen log categories
Common Gaps
• Logging decisions made by default or without formal review
• Required events not logged consistently across systems
• Logs collected, but lacking key security events like failed logins or file access
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Logging all essential security events (authentication, access, system changes) by default
• Providing a list of logged event types that align with CMMC and NIST guidance
• Helping you define a logging baseline tailored to your environment
• Offering advisory support for documenting and reviewing log requirements
With Cuick Trac, logging priorities are not guesswork—they’re structured, documented, and compliance-ready.
Final CTA
It’s not about logging everything—it’s about logging the right things.
Schedule a Cuick Trac demo and focus your audit logging where it matters most.