NIST 800-171 3.3.3 (AU.L2-3.3.3): Review Logged Events
Review and update logged events.
CMMC Level 2 practice AU.L2-3.3.3
What 3.3.3 means in practice
The list of events you log is not fixed. Set a schedule, for example yearly or after an incident or a major change, to review which event types are captured, and add or drop types based on what the review finds.
SPRS points and the CMMC POA&M
- CMMC Level 2 practice
- AU.L2-3.3.3
- SPRS points
- 1 point. When it is not met, the DoD Assessment Methodology subtracts 1 from the score of 110.
- CMMC POA&M
- Allowed. It is worth 1 point, and 32 CFR 170.21(a)(2)(ii) admits requirements worth 1 point. Conditional status also needs a score of at least 88, and the item must be closed within 180 days.
Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.
What an assessor checks for 3.3.3
NIST SP 800-171A gives 3 determination statements for 3.3.3, each found satisfied or other than satisfied. Determine if:
- 3.3.3[a] a process for determining when to review logged events is defined.
- 3.3.3[b] event types being logged are reviewed in accordance with the defined review process.
- 3.3.3[c] event types being logged are updated based on the review.
NIST SP 800-171A (June 2018), assessment objectives for 3.3.3
Evidence that shows 3.3.3 is met
- The documented review process and how often it runs.
- Records of past reviews and the decisions they reached.
- Change records showing the logging configuration updated after a review.
How PolicyCortex gathers the evidence
No PolicyCortex collector reads the evidence for 3.3.3. Your team provides the evidence listed above.
Meet the requirement once. Keep the evidence current.
- Published
- Last updated
- Unchanged since publication