NIST 800-171 Controls · Audit & Accountability

AU.2.001 — Create and Retain System Audit Logs

CMMC Level 2SPRS if unmet: -5CRITICAL priority~8h to implement

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

What AU.2.001 means in plain English

Your computers need to keep a diary of who logged in, when, what files were opened, and what changes were made—especially to anything touching CUI like contract drawings or specs. Windows does this automatically through Event Viewer and Microsoft 365 does it through the Unified Audit Log, but you have to turn it on and make sure the logs are kept long enough (at least 90 days online, 1 year archived is the DoD expectation). If you ever have a breach or an employee dispute, these logs are your only evidence of what actually happened.

The assessment question

“Are audit logs enabled on all systems that process, store, or transmit CUI, and are those logs retained for at least 90 days with evidence of the retention configuration?”

How to implement AU.2.001

On every Windows workstation and server: open Group Policy (gpedit.msc) and navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration. Enable "Audit Logon Events," "Audit Object Access," "Audit Account Management," and "Audit Process Creation" for both Success and Failure.
For Microsoft 365: go to the Microsoft Purview compliance portal (compliance.microsoft.com), select "Audit," and verify that audit logging is turned ON. M365 Business Premium retains audit logs for 90 days by default; E3/E5 retains for 1 year.
Configure Windows Event Log retention: open Event Viewer > right-click "Security" log > Properties > set maximum log size to at least 1 GB and select "Archive the log when full, do not overwrite events."
Set up a monthly task to export and archive Windows Security logs to a protected folder (e.g., \\server\CMMC-Evidence\AuditLogs\YYYY-MM). Keep archives for at least 12 months.
Document your log retention configuration with screenshots and store them in your CMMC evidence folder under "AU — Audit Logs."

Evidence your assessor will ask for

Screenshots of Group Policy audit settings showing which event categories are enabled
Screenshot of Microsoft 365 audit log status showing it is enabled
Windows Event Log retention settings (max size, archive policy) — screenshot from Event Viewer
Sample exported audit log file demonstrating records are being captured
Written log retention policy specifying minimum 90-day online and 1-year archive retention

Does AI prompt monitoring help with this control? Yes — directly.

AU.2.001 is one of the requirements a local AI prompt firewall concretely evidences. When employees send prompts to ChatGPT, Copilot, or Claude, that traffic crosses your external boundary — HoundShield inspects it on your own infrastructure (self-hosted Docker, Mode B), blocks CUI patterns before transmission, and writes every allowed/blocked event to a SHA-256 hash-chained log attributable to the user. Architecture diagram, active pattern set, and a log sample are the evidence an assessor tests this against for the AI data path.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Audit & Accountability controls

AU.2.002

Ensure User Accountability Through Unique Identifiers

AU.2.003

Review and Update Logged Events

AU.2.004

Alert on Audit Logging Process Failure

AU.2.005

Correlate Audit Review, Analysis, and Reporting

AU.2.006

Provide Audit Record Reduction and Report Generation

AU.2.007

Provide System Clock Capability for Audit Timestamps

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment