Audit & Accountability
Audit and Accountability is about keeping the records that let you, and anyone reviewing your work, reconstruct what happened on your systems. If something goes wrong, logs are the difference between knowing and guessing.
The 9 Audit & Accountability requirements
29 assessment objectives across this family.
- 3.3.1System AuditingCreate and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.5 pt✕ POA&M
- 3.3.2User AccountabilityEnsure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.3 pt✕ POA&M
- 3.3.3Event ReviewReview and update logged events.1 pt
- 3.3.4Audit Failure AlertingAlert in the event of an audit logging process failure.1 pt
- 3.3.5Audit CorrelationCorrelate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.5 pt✕ POA&M
- 3.3.6Reduction & ReportingProvide audit record reduction and report generation to support on-demand analysis and reporting.1 pt
- 3.3.7Authoritative Time SourceProvide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.1 pt
- 3.3.8Audit ProtectionProtect audit information and audit logging tools from unauthorized access, modification, and deletion.1 pt
- 3.3.9Audit ManagementLimit management of audit logging functionality to a subset of privileged users.1 pt
Build Audit & Accountability, and all 14 families, with an officer
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
Questions, answered
How many CMMC Level 2 requirements are in Audit & Accountability?+
The Audit & Accountability family (AU) has 9 of the 110 CMMC Level 2 requirements, assessed against 29 objectives from NIST SP 800-171A.
What is the Audit & Accountability family about?+
Audit and Accountability is about keeping the records that let you, and anyone reviewing your work, reconstruct what happened on your systems. If something goes wrong, logs are the difference between knowing and guessing.