NIST 800-171 Controls · Audit & Accountability

AU.2.006 — Provide Audit Record Reduction and Report Generation

CMMC Level 2SPRS if unmet: -1LOW priority~4h to implement

Provide audit record reduction and report generation to support on-demand analysis and reporting.

What AU.2.006 means in plain English

Raw audit logs are overwhelming—a small Windows workstation can generate thousands of events per day. You need a way to filter, sort, and report on logs so you can answer questions like "Show me everything user john.smith did between March 1 and March 5" or "Show me all failed logins in the last 30 days" without wading through millions of lines. Windows Event Viewer has built-in filtering. Microsoft 365 has a search-and-export function. For a small shop these built-in tools are sufficient as long as you document how to use them.

The assessment question

“Is there a documented capability and procedure for filtering, searching, and generating reports from audit logs to support on-demand investigation, with evidence that personnel know how to use it?”

How to implement AU.2.006

In Windows Event Viewer, practice creating a Custom View: Action > Create Custom View > filter by Event Level, Event Source, and Event ID. Save a custom view for "Failed Logons" (Event ID 4625) and another for "Account Management" (Event IDs 4720, 4722, 4725, 4726, 4728, 4732, 4756). Screenshot these saved views as evidence.
In Microsoft Purview (compliance.microsoft.com > Audit), practice running and exporting an audit search: set date range, select user, select activities (e.g., "FileDownloaded"), export to CSV. Save one sample export as evidence.
Document a one-page "Log Query Reference Card" showing the 5-6 most important searches your shop needs (failed logins, file access by a specific user, after-hours activity, bulk downloads) with step-by-step instructions for running each query.
If using Wazuh, document the equivalent queries/dashboards and save screenshots of the built-in security overview dashboards.
Test the process: have the IT-responsible person run a sample report on-demand and document the result. This demonstrates the capability is working and personnel know how to use it.

Evidence your assessor will ask for

Screenshot of saved Windows Event Viewer custom views for key security events
Sample Microsoft 365 audit log export (CSV) showing the export capability works
Log Query Reference Card documenting standard queries and how to run them
Evidence that the IT-responsible person has run at least one on-demand log report

Does AI prompt monitoring help with this control? It supports it.

AI prompt monitoring does not satisfy AU.2.006 on its own, but its output feeds the capability this control requires: the tamper-evident event stream of allowed and blocked AI prompts becomes detection signal, incident record, and reviewable audit material. Treat the AI firewall as one input to this practice, alongside the remediation steps above.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Audit & Accountability controls

AU.2.001

Create and Retain System Audit Logs

AU.2.002

Ensure User Accountability Through Unique Identifiers

AU.2.003

Review and Update Logged Events

AU.2.004

Alert on Audit Logging Process Failure

AU.2.005

Correlate Audit Review, Analysis, and Reporting

AU.2.007

Provide System Clock Capability for Audit Timestamps

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment