CMMCpedia
Work with me

Requirements / Audit and Accountability (AU)

AU.L2-3.3.5

Audit Correlation

Official Source Material

SPRS score value
5 points.
POA&M eligibility
Not eligible. It is worth more than 1 point.
Level 1
Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

Determine if:

  1. [a] audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity are defined; and
  2. [b] defined audit record review, analysis, and reporting processes are correlated.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Correlate means the logs, the review, and the response work as one system.

Objective [a] asks you to define review, analysis, and reporting processes aimed at suspicious activity, and [b] asks that they connect instead of running independently. Cover both readings of connect. Collect logs into one place so events from different systems can be compared. Write the procedure that turns a suspicious finding into an incident under your incident response plan.

Central collection is what makes correlation demonstrable.

When tenant logs, endpoint logs, and firewall logs land in one log workspace, correlation is a query across sources. The assessment guide accepts manual correlation with well defined and managed procedures for small companies. A documented recurring review that compares sources also works. It is just harder to demonstrate than a query.

A year of zero findings undermines you.

A review process that never escalates anything looks like a process that does not run. Record triage outcomes even when they are benign: the sign-in alert that turned out to be a traveling employee is evidence the pipeline from log to review to decision works.

AU.L2-3.3.5 is a five point requirement with no POA&M path.

32 CFR 170.24 assigns it five points. 32 CFR 170.21 keeps a five point requirement off a POA&M. Treat the link between logging and response as day one work.

What falls short

  • Logs collected and even reviewed, with no defined path from a suspicious finding to incident response. The processes exist but are not correlated, so [b] fails.

Edge cases

  • The data an endpoint detection tool collects can stand in for operating system event logs. Define it as your endpoint source under AU.L2-3.3.1, let this requirement's processes read from it, and keep the definitions aligned so the assessor sees one coherent logging story.

Over-engineering

  • A managed detection and response contract signed to answer [b]. Central collection, a defined review, and a written path from a finding into incident response correlate the processes.
  • Correlation rules written for an enterprise threat model. The objectives ask that review, analysis, and reporting connect, not that you detect every attack pattern.