CMMC Audit and Accountability (AU) Logging Requirements and SIEM

The Audit and Accountability (AU) domain is where many DIB assessments stumble: logs exist, but retention, protection, review, and correlation do not match the SSP. SIEM is not named as a mandatory product in every requirement line — but operationally it is how most OSCs prove AU (and related SI monitoring) at Level 2’s 110-requirement depth.

Related: CMMC hub · 14 domains · SIEM for CMMC · DFARS 7012 IR.

Spreadsheet SIEM fails interviews: Assessors sample whether reviews happen, who is alerted, and whether audit records are protected from unauthorized alteration.

What AU Programmes Must Show

Audit events defined for in-scope systems
Audit record content sufficient for after-the-fact investigation
Retention consistent with the SSP
Protection of audit information
Review / analysis / reporting processes with accountable roles

Where SIEM Fits

A SIEM (such as ThreatHawk) centralizes sources from identity, endpoints, cloud (including GCC High audit logs), firewalls, and applications; correlates for IR; and produces review artefacts assessors can sample. Pair with CSA so each AU control ID links to queries and tickets.

How CyberSilo Helps

ThreatHawk log pipelines and detection content
CSA requirement linkage for AU/SI evidence
IR handoff patterns aligned to 72-hour DFARS 7012 reporting needs

Make AU Evidence Sampleable

Connect log sources, retention, and review tickets to AU requirement IDs before assessment week.

Talk to CyberSilo CMMC Automation

Frequently Asked Questions

Is a SIEM explicitly mandatory for CMMC?

The requirements demand audit and monitoring capabilities. Most OSCs meet them with a SIEM or equivalent centralized logging platform documented in the SSP.

Which level cares most about AU depth?

Level 2’s 110 NIST SP 800-171 Rev 2 requirements include the AU family at full depth. Level 1’s 15 FAR requirements are lighter but still expect basic system logging/safeguards as applicable.

Does ThreatHawk replace IR process?

No. It supplies telemetry and alerting. Incident decisions and DFARS reporting remain process obligations.

CMMC hub · 14 domains · CSA · ThreatHawk

CMMC Audit and Accountability (AU) Logging Requirements and SIEM

What AU Programmes Must Show

Where SIEM Fits