How many SPRS points can the Audit and Accountability family cost?

Up to 19 of the 313 points a score can lose: 2 worth 5 points, 1 worth 3 and 6 worth 1.

Which Audit and Accountability requirements can go on a CMMC POA&M?

6 of the 9: 3.3.3, 3.3.4, 3.3.6, 3.3.7, 3.3.8 and 3.3.9, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

NIST 800-171 3.3 Audit and Accountability

Audit and Accountability covers the logs: deciding what to record, tying every action to a person, alerting when logging fails, keeping clocks in step, and protecting the records so they can support an investigation.

9 requirementsup to 19 SPRS points6 can go on a CMMC POA&MPublished 2026-11-11

The 9 Audit and Accountability requirements

3.3.1 System Audit LogsAU.L2-3.3.1Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.5 points
3.3.2 User AccountabilityAU.L2-3.3.2Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.3 points
3.3.3 Review Logged EventsAU.L2-3.3.3Review and update logged events.1 point
3.3.4 Audit Failure AlertsAU.L2-3.3.4Alert in the event of an audit logging process failure.1 point
3.3.5 Audit CorrelationAU.L2-3.3.5Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.5 points
3.3.6 Audit ReductionAU.L2-3.3.6Provide audit record reduction and report generation to support on-demand analysis and reporting.1 point
3.3.7 Authoritative TimeAU.L2-3.3.7Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.1 point
3.3.8 Audit ProtectionAU.L2-3.3.8Protect audit information and audit logging tools from unauthorized access, modification, and deletion.1 point
3.3.9 Audit ManagementAU.L2-3.3.9Limit management of audit logging functionality to a subset of privileged users.1 point

Audit and Accountability: points and the CMMC POA&M

Q-01
How many SPRS points can the Audit and Accountability family cost?
Up to 19 of the 313 points a score can lose: 2 worth 5 points, 1 worth 3 and 6 worth 1.
Q-02
Which Audit and Accountability requirements can go on a CMMC POA&M?
6 of the 9: 3.3.3, 3.3.4, 3.3.6, 3.3.7, 3.3.8 and 3.3.9, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

Related pages

Calculator: SPRS score calculator: mark the Audit and Accountability requirements and see what they cost.
Sample package: Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.
Previous family: 3.2 Awareness and Training
Next family: 3.4 Configuration Management
All requirements: All 110 NIST SP 800-171 requirements, by family.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where the evidence is stored in each delivery mode.
authorization: Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
baseline: NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.