AU.2.003 — Review and Update Logged Events

What AU.2.003 means in plain English

The list of things your systems record in their logs should not be set once and forgotten. Once a year (or whenever your IT setup changes significantly—you add a new server, move to cloud storage, bring on a new contract), review whether you are logging the right events. A machine shop that just got its first file server needs different log settings than one that has been running a server for five years. Keep a written record of when you reviewed the log policy and what you decided.

The assessment question

“Is there a documented annual review of audit log configurations to verify that the correct events are being captured for all systems processing CUI, with records of those reviews retained?”

How to implement AU.2.003

1. Create a one-page "Audit Event Review Checklist" that lists every system (workstations, servers, M365, network devices) and the events currently being logged for each.
2. Once per year—schedule it alongside your annual security awareness training—walk through the checklist. Ask: Did we add new systems? Did we change how we store CUI? Are there new threat types (ransomware via email is common in machine shops) that need new log coverage?
3. Update the audit policy in Group Policy or M365 to reflect any changes identified during the review.
4. Document the review outcome in a simple memo: "Annual Audit Log Review — [Date] — Reviewer: [Name] — Finding: No changes needed / Changes made: [describe]." Sign and date it.
5. File the memo in your CMMC evidence folder under "AU — Event Review."

Evidence your assessor will ask for

• Dated and signed annual audit event review memo or checklist
• Current audit policy configuration (screenshot) showing events being logged
• Record of any changes made to log settings as a result of the review
• Evidence that the review covers all systems processing CUI

More Audit & Accountability controls