NIST SP 800-171 REV. 3 Audit and Accountability

• 03.03.01 Event Logging

  Specify the following event types selected for logging within the system:[Assignment: organization-defined event types].

• 03.03.02 Audit Record Content

  Include the following content in audit records:

• 03.03.03 Audit Record Generation

  Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02.

• 03.03.04 Response to Audit Logging Process Failures

  Alert organizational personnel or roles within [Assignment: organization-defined time period] in the event of an audit logging process failure.

• 03.03.05 Audit Record Review, Analysis, and Reporting

  Review and analyze system audit records [Assignment: organization-defined frequency] for indications and the potential impact of inappropriate or unusual activity.

• 03.03.06 Audit Record Reduction and Report Generation

  Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents.

• 03.03.07 Time Stamps

  Use internal system clocks to generate time stamps for audit records.

• 03.03.08 Protection of Audit Information

  Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

Need help putting this into practice? See our NIST SP 800-171 & CMMC compliance services or read our NIST SP 800-171 & CMMC articles.