---
title: "NIST 800-171 3.3 Audit and Accountability"
description: "The 9 NIST SP 800-171 Audit and Accountability requirements (3.3, CMMC AU): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/audit-and-accountability
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/audit-and-accountability
records: 4
digest: sha3:a84e742dbf460c7313b1c64cc6e2e56c7ef6b39bb0c0c96c7904ed2f2ba0666c
---

# NIST 800-171 3.3 Audit and Accountability

NIST 800-171 / Audit and Accountability

Audit and Accountability covers the logs: deciding what to record, tying every action to a person, alerting when logging fails, keeping clocks in step, and protecting the records so they can support an investigation.

9 requirements · up to 19 SPRS points · 6 can go on a CMMC POA&M

## The 9 Audit and Accountability requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.3.1 System Audit Logs](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.1) | AU.L2-3.3.1 | 5 points | Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. |
| [3.3.2 User Accountability](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.2) | AU.L2-3.3.2 | 3 points | Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. |
| [3.3.3 Review Logged Events](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.3) | AU.L2-3.3.3 | 1 point | Review and update logged events. |
| [3.3.4 Audit Failure Alerts](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.4) | AU.L2-3.3.4 | 1 point | Alert in the event of an audit logging process failure. |
| [3.3.5 Audit Correlation](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.5) | AU.L2-3.3.5 | 5 points | Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. |
| [3.3.6 Audit Reduction](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.6) | AU.L2-3.3.6 | 1 point | Provide audit record reduction and report generation to support on-demand analysis and reporting. |
| [3.3.7 Authoritative Time](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.7) | AU.L2-3.3.7 | 1 point | Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. |
| [3.3.8 Audit Protection](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.8) | AU.L2-3.3.8 | 1 point | Protect audit information and audit logging tools from unauthorized access, modification, and deletion. |
| [3.3.9 Audit Management](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.9) | AU.L2-3.3.9 | 1 point | Limit management of audit logging functionality to a subset of privileged users. |

## Audit and Accountability: points and the CMMC POA&M

**Q: How many SPRS points can the Audit and Accountability family cost?**
A: Up to 19 of the 313 points a score can lose: 2 worth 5 points, 1 worth 3 and 6 worth 1.

**Q: Which Audit and Accountability requirements can go on a CMMC POA&M?**
A: 6 of the 9: 3.3.3, 3.3.4, 3.3.6, 3.3.7, 3.3.8 and 3.3.9, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Audit and Accountability requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-AU)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.2 Awareness and Training](https://policycortex.com/nist-800-171/awareness-and-training)
- **Next family**: [3.4 Configuration Management](https://policycortex.com/nist-800-171/configuration-management)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | e38ec6ebfe77 | 71c35121a840 |
| REC 0001 | REQUIREMENTS | 1d1d3173099e | e38ec6ebfe77 |
| REC 0002 | POINTS AND POA&M | a66b0becacfc | 1d1d3173099e |
| REC 0003 | RELATED | a84e742dbf46 | a66b0becacfc |

Head sha3:a84e742dbf460c7313b1c64cc6e2e56c7ef6b39bb0c0c96c7904ed2f2ba0666c. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.