This objective requires organizations to verify through configuration settings that all system components identified as having audit capabilities are actually set up to generate audit records, particularly those that process or secure Controlled Unclassified Information (CUI).