CMMC Practice AU.L2-3.3.3

Event Review: Review and update logged events.

Monarch ISC Guidance

This is an extension of AU.L2-3.3.1 and arguably a part of ensuring that practice's effectiveness. The end result is your organization must periodically review your audit plan and ensure that the items you wish to log are still being logged, that new audit options are reviewed for applicability in your organization, or if options previously ignored should now be put into practice. Set up a schedule to do this on a regular basis, assign it to someone, and track its completion.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 The intent of this requirement is to periodically re-evaluate which logged events will continue to be included in the list of events to be logged. The event types that are logged by organizations may change over time. Reviewing and updating the set of logged event types periodically is necessary to ensure that the current set remains necessary and sufficient.