NIST 800-171 Audit and Accountability (3.3): Log Retention and SIEM Requirements

Rev 2 Requirements (3.3.1–3.3.9)

SIEM Mapping (Pattern, Not a Mandate)

A central SIEM commonly supports 3.3.1 and 3.3.4–3.3.8; identity feeds support 3.3.2; content filters support 3.3.3 and 3.3.6. Retention is organization- or contract-defined — 800-171 says retain to the extent needed, not a universal “90 days” myth.

How CyberSilo Helps

• ThreatHawk SIEM — collection, correlation, alerting, retention controls
• Compliance Standards Automation — link each 3.3.x to evidence IDs for SSP and SPRS

Frequently Asked Questions

Is one year of retention mandatory?

Not as a universal 800-171 constant. Define and justify retention for investigative needs and contracts.

Does 3.3 require FIPS cryptography?

Protecting audit information may involve cryptography controls elsewhere (for example 3.13.11) depending on architecture.

Is this Rev 3 numbering?

This page uses Rev 2 series 3.3.1 through 3.3.9. Cite the revision in your SSP if you are preparing for Rev 3.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · ThreatHawk SIEM