• Ignyte CMMC Specialist


The audit is a key part of NIST 171 requirements especially now with the CMMC certification process.

Retention of records for purpose of audibility is important for these requirements. Retained records also help with the evidence required for investigations and audits.

Audit and Accountability

3.3.1 Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity.

Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs.

Event types can include:

  • Password changes

  • Failed logons or failed accesses related to systems

  • Administrative privilege usage

  • Third-party credential usage.

Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network.

Audit record content that may be necessary to satisfy this requirement includes

  • Time stamps

  • Source and destination addresses

  • User/process identifiers

  • Event descriptions

  • Success/fail indications

  • Filenames involved

  • Access control or flow control rules invoked

NIST Special Publication 800-92 provides guidance on security log management.

3.3.2 Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

This requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible.

Audit record review, analysis, and reporting covers information security-related logging performed by organizations including:

  • Logging that results from monitoring of account usage

  • Remote access

  • Wireless connectivity

  • Mobile device connection

  • Configuration settings

  • Use of maintenance tools

  • Nonlocal maintenance

  • Physical access

  • Temperature and humidity

  • Equipment delivery and removal

  • System component inventory

  • Communications at the system boundaries

  • Use of mobile code

  • Use of VoIP

3.3.3 Review and update audited events.

The intent of this requirement is to periodically re-evaluate which of the logged events will continue to be included in the list of events to be logged.

Reviewing and updating the set of logged event types periodically is necessary to ensure that the current set remains necessary and sufficient.

3.3.4 Alert in the event of an audit process failure.

Audit logging process failures include:

  • Software/hardware errors

  • Failures in the audit record capturing mechanisms

  • Audit record storage capacity being reached or exceeded.

3.3.5 Correlate audit review, analysis, and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity.

Correlating these processes helps to ensure that they do not operate independently but rather collectively.

3.3.6 Provide audit reduction and report generation to support on-demand analysis and reporting.

Audit record reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts.

Audit record reduction and report generation capabilities do not always emanate from the same system or organizational entities conducting auditing activities.

3.3.7 Provide an information system capability that compares and synchronizes internal system clocks with an authoritative source to generate timestamps for audit records.

Time stamps generated by the system include date and time.

Time is expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.

This requirement provides uniformity of time stamps for systems with multiple system clocks and systems connected over a network.

See IETF Network Time Protocol.

3.3.8 Protect audit information and audit tools from unauthorized access, modification, and deletion.

Audit information includes all information needed to successfully audit system activity.

Audit logging tools are those programs and devices used to conduct audit and logging activities.

This requirement focuses on the technical protection of audit information and limits the ability to access and execute audit logging tools to authorized individuals.

3.3.9 Limit management of audit functionality to a subset of privileged users.

Individuals with privileged access to a system and who are also the subject of an audit by that system, may affect the reliability of audit information by inhibiting audit logging activities or modifying audit records.

This requirement specifies that privileged access be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges.

For further Information and Demo, please contact us:

  • LinkedIn
  • Facebook
  • Twitter
  • Instagram
  • YouTube
  • Pinterest | 1.833.IGNYTE1 


Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Generic disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Gartner is a registered trademark and service mark of Gartner, Inc. and/or of its affiliates in the U.S. and internationally, and is used herein with permission. All rights reserved

Igntye © 2020 All Rights Reserved. Ignyte Assurance Platform, Privacy Policy and Terms of Service.