Provide audit record reduction and report generation to support on-demand analysis and reporting
📖 What This Means
This control requires organizations to have tools and processes in place to filter and summarize audit logs into reports that can be quickly analyzed. Essentially, it means being able to sift through large volumes of log data to find relevant information efficiently. For example, if a security incident occurs, you should be able to generate a report showing all relevant log entries without manually searching through thousands of lines. This is crucial for timely incident response and ongoing monitoring. Real-world examples include using a Security Information and Event Management (SIEM) tool to generate a report of failed login attempts or exporting logs to a spreadsheet for further analysis.
🎯 Why It Matters
Without the ability to reduce and report on audit logs, organizations risk missing critical security events buried in large volumes of data. This can lead to delayed detection of breaches, increased damage, and regulatory penalties. For instance, in the 2017 Equifax breach, failure to analyze logs promptly contributed to the breach going unnoticed for months, affecting 147 million people. The DoD emphasizes this control to ensure defense contractors can quickly identify and respond to threats involving Controlled Unclassified Information (CUI). The potential impact includes financial losses, reputational damage, and loss of contracts.
✅ How to Implement
- Enable logging features in your cloud platform (e.g., AWS CloudTrail, Azure Monitor, GCP Audit Logs).
- Configure log aggregation using cloud-native tools like AWS CloudWatch Logs or Azure Log Analytics.
- Set up automated report generation using tools like Splunk Cloud or Datadog.
- Define filters and queries to reduce logs to relevant events (e.g., failed logins, unauthorized access attempts).
- Schedule regular report generation and distribution to security teams.
- Ensure logs are stored securely with proper access controls.
- Test report generation tools to confirm they meet CMMC requirements.
📋 Evidence Examples
SIEM Configuration Documentation
Sample Audit Report
Log Reduction Procedure
Training Records
Test Results
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For AU.L2-3.3.6 ("Provide audit record reduction and report generation to support on-demand analysis and reporting"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe your audit logging infrastructure, including which events are logged, the SIEM/log management platform, retention periods, log protection mechanisms, and review processes. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"AU.L2-3.3.6 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to provide audit record reduction and report generation to support on-demand analys.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"AU.L2-3.3.6 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to provide audit record reduction and report generation to support on-demand analys.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"AU.L2-3.3.6 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all systems generating audit logs within the CUI boundary
- • Document log flow from sources to centralized SIEM
- • Specify log storage locations and retention tiers
- • Ensure this control covers all systems within your defined CUI boundary where provide audit record reduction and report generation to support on-demand analysis and reporting applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Audit and Accountability Policy
- 📄 SIEM architecture documentation
- 📄 Log retention configuration
- 📄 Evidence artifacts specific to AU.L2-3.3.6
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will verify that required events are logged, check log completeness (all required fields present), test log protection mechanisms, and review evidence of regular log reviews.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a centralized logging solution in place?
Question 2: Are logs being forwarded to the centralized solution?
Question 3: Can you generate reports on-demand?
Question 4: Is log reduction being performed regularly?
Question 5: Have you tested the log reduction and reporting process?
⚠️ Common Mistakes (What Auditors Flag)
1. Incomplete log collection
2. No automated reporting
3. Poor log storage security
4. Lack of training
5. Untested processes
📚 Parent Policy
This practice is governed by the Audit and Accountability Policy