Family 3.3 9 requirements
Audit & Accountability.
Log everything that matters. Review what you log.
The big picture
Auditing isn't about ticking a box. The assessor will ask to see real reviews and real responses to anomalies — not just that the logs exist.
Cloud platforms generate most of these logs natively — see what your cloud handles vs what you own.
Theme 1
Logging setup.
3.3.1 — 3.3.3What gets captured, why, and keeping it under review as the system changes.
- 3.3.1 Log Everything. AU.L2-3.3.1 · System Auditing Turn on logging across all CUI systems. Define what to capture. Keep logs long enough to investigate. 3.3.2 Trace Every Action. AU.L2-3.3.2 · User Accountability Every action ties back to a named person. No shared accounts. No anonymous activity. 3.3.3 Review What You Log. AU.L2-3.3.3 · Event Review Periodically review and adjust what events you're logging as threats and systems change.
Theme 2
Review and respond.
3.3.4 — 3.3.6Alerting on log failures, correlating events, and responding to what the audit reveals.
- 3.3.4 Alert When Logging Breaks. AU.L2-3.3.4 · Audit Failure Alerting If logging stops on any system, designated personnel are alerted immediately. 3.3.5 Connect the Dots. AU.L2-3.3.5 · Audit Correlation Correlate logs from multiple sources to spot attack patterns that individual logs would miss. 3.3.6 Search and Report. AU.L2-3.3.6 · Reduction & Reporting Search, filter, and generate reports from audit logs on demand — not raw files, usable answers.
Theme 3
Time and protect.
3.3.7 — 3.3.9Synchronised clocks, protected log records, and tightly scoped audit-management privileges.
- 3.3.7 Sync the Clocks. AU.L2-3.3.7 · Authoritative Time Source All system clocks synchronized to the same authoritative time source via NTP. 3.3.8 Tamper-Proof Logs. AU.L2-3.3.8 · Audit Protection Protect audit logs and logging tools from unauthorized access, modification, and deletion. 3.3.9 Limit Who Manages Logs. AU.L2-3.3.9 · Audit Management Only a designated subset of privileged users can configure or manage audit logging.