Audit and Accountability is the family that looks least important on paper and fails most often in practice. Its nine requirements carry only 19 points — the lowest density of any family at 2.11 points each — yet three of them sit in DCMA DIBCAC's list of the ten requirements most often found "other than satisfied".
Low stakes, high failure rate. The reason is that collecting logs is easy, while defining what to log, noticing when logging stops, and actually reviewing what was logged require ongoing process that many organizations never put in place.
What the Audit and Accountability family covers
Audit and Accountability contains 9 requirements, numbered 3.3.1 to 3.3.9 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix AU.L2, so 3.3.1 appears as AU.L2-3.3.1.
The family covers creating and retaining logs (3.3.1), attributing actions to individuals (3.3.2), maintaining the list of logged events (3.3.3), alerting on logging failure (3.3.4), correlating and reporting (3.3.5, 3.3.6), time synchronization (3.3.7), and protecting the logs themselves (3.3.8, 3.3.9).
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.3.1 | Create and retain system audit logs and records to enable monitoring, analysis, investigation and reporting | 5 | No |
| 3.3.2 | Ensure the actions of individual users can be uniquely traced to those users | 3 | No |
| 3.3.3 | Review and update logged events | 1 | Eligible |
| 3.3.4 | Alert in the event of an audit logging process failure | 1 | Eligible |
| 3.3.5 | Correlate audit record review, analysis and reporting processes | 5 | No |
| 3.3.6 | Provide audit record reduction and report generation | 1 | Eligible |
| 3.3.7 | Synchronize system clocks with an authoritative time source | 1 | Eligible |
| 3.3.8 | Protect audit information and logging tools from unauthorized access, modification and deletion | 1 | Eligible |
| 3.3.9 | Limit management of audit logging functionality to a subset of privileged users | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 19 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.3.1 and 3.3.5. 3.3.2 is worth three points. The remaining 6 are worth one point each.
Only 3.3.1 and 3.3.5 carry five points. The DIBCAC failures at 3.3.3 and 3.3.4 are one-point requirements, which is why organizations deprioritize them — and why they keep failing. Their point value is low, but an assessor who finds that nobody reviews the log list or notices when collection stops will look harder at everything else in the family.
The three most-failed AU requirements
3.3.3 (review and update logged events) fails because the organization never wrote down which events it logs and why, so there is nothing to review. 3.3.4 (alert on logging failure) fails because nothing notifies anyone when an agent stops sending or a log volume fills up. 3.3.5 (correlate review, analysis and reporting) fails because there is no central platform or because "suspicious activity" was never defined.
All three are process failures that a central log platform makes straightforward: a documented event list reviewed on a schedule, a health alert on every log source, and correlation rules tied to a short list of behaviors you care about. The DIBCAC list was presented in 2023 from 117 assessments and is the best public dataset available, though not current-year.
A logging program that passes
Write down the event types you log for each class of system — logons, privilege use, account changes, policy changes, access to CUI repositories — and review the list at least annually under 3.3.3. Send every source to a central platform that raises an alert when a source goes quiet, which satisfies 3.3.4. Define a short list of suspicious behaviors and build correlation rules for them under 3.3.5. Keep review records. Those four steps address the three most-failed requirements directly.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.3.3, 3.3.4, 3.3.6, 3.3.7, 3.3.8 and 3.3.9 eligible for deferral.
Six of the nine requirements are deferrable, including the two most-failed one-pointers. That is a reason to be careful: a POA&M full of logging items signals to a reviewer that monitoring is not working, which undermines confidence in incident response as well.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- A written list of logged event types per system class, with the date it was last reviewed.
- Log retention settings and the location of retained logs.
- Alert configuration for logging failures and an example alert.
- SIEM or correlation rules and records of periodic review.
- Time synchronization settings showing an authoritative source.
- Access controls on log data limited to a small group of administrators.
Frequently asked questions
Do we need a SIEM to meet NIST 800-171?
The standard does not name a technology, but meeting 3.3.5 without a central platform that correlates events is difficult. Many smaller organizations use a managed SIEM service.
How long must audit logs be retained?
NIST SP 800-171 leaves retention to the organization. DFARS 252.204-7012 requires preserving images of affected systems for 90 days after an incident report, so most organizations retain logs at least 90 days and often a year.
Does 3.3.2 require individual accounts?
Yes. Shared accounts prevent actions from being traced to a person, which fails 3.3.2.
Who should be able to delete logs?
Ideally nobody routinely. 3.3.8 and 3.3.9 require protecting audit information and limiting log management to a small set of privileged users; immutable or write-once storage makes the evidence simple.