System Auditing

Official Source Material

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Determine if:

[a] audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified;
[b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined;
[c] audit records are created (generated);
[d] audit records, once created, contain the defined content;
[e] retention requirements for audit records are defined; and
[f] audit records are retained as defined.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Half of this requirement is writing, not configuration.

Objectives [a], [b], and [e] ask for decisions: which event types you log, what each record contains, and how long you keep records. Objectives [c], [d], and [f] ask for proof the systems match the decisions. Write the event list, the record content, and the retention period into your audit policy or system security plan, the document that describes how your system meets each requirement. Then configure systems to match, because an assessor checks the configuration against the document.

You decide which events are needed, so decide from an established baseline.

Objective [a] says the event types to be logged are specified, and you are the one specifying them. Start from a published audit baseline, such as the DISA STIG settings, the Defense Department's published audit configuration for your operating systems. Remove what you cannot use, and record why. A written selection you can defend beats an exhaustive one you cannot maintain.

Cloud tenant logging covers the tenant, not your endpoints.

If you run Microsoft 365, keep the unified audit log active and retain the Microsoft Entra ID sign-in and audit logs. Together they record account activity across the tenant, your organization's slice of the service. Your laptops and servers still need a Windows audit policy pushed by group policy or your device management tool. The default policy omits event types an investigation will want, such as removable media use.

Define retention in months and prove the platform honors it.

The assessment guide says the retention period must account for the weeks or months between a compromise and its discovery. A 30 day default is not a defensible answer for [e]. Define a retention period of at least a year, write it down, and capture the retention settings that enforce it as evidence for [f]. Where a platform caps retention below your defined period, export the logs to storage you control.

AU.L2-3.3.1 is a five point requirement with no POA&M path.

32 CFR 170.24 assigns it five points. 32 CFR 170.21 keeps a five point requirement off a POA&M, the plan of action and milestones that lets certain gaps be closed after assessment. Miss it and you are five points down with no conditional close-out available. Build logging early instead of treating it as cleanup.

What falls short

Logging turned on everywhere with no written list of event types or record content. Objectives [a] and [b] ask for the specification, and a configuration alone does not show one.
An endpoint detection tool's short built-in query window offered as your retention. When the tool holds less than your defined retention period, [f] is not met.
A default audit baseline nobody reviewed, offered as the specification for [a]. Adopting a baseline is fine, but adopting it unread means you cannot explain how it enables monitoring and investigation.

Edge cases

A cloud service logs a fixed event set you cannot change. Specify which of its event types you rely on and cite the vendor's documentation for record content, because the specification is still yours even when the settings are not.
Logging every file access can crush system performance. The requirement lets you decide failed file access on a busy server is not needed to monitor the confidentiality of CUI, controlled unclassified information, if you record the decision.