CMMC 2.0 AU.L2-3.3.2: User Accountability

What else in your programme already covers this

This control maps to 55 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 6 controls

NIST800-AU-10 AU-10 Non-repudiation
NIST800-AU-12 AU-12 Audit Record Generation
NIST800-AU-2 AU-2 Event Logging
NIST800-AU-3 AU-3 Content of Audit Records
NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting
NIST800-AU-8 AU-8 Time Stamps

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

CCM-IAM-13 Uniquely Identifiable Users
CCM-LOG-04 Audit Logs Access and Accountability
CCM-LOG-08 Log Records
CCM-LOG-12 Access Control Logs

FedRAMP High · 4 controls

AU-12 Audit Record Generation
AU-3 Content of Audit Records
AU-3(1) Additional Audit Information
IA-2 Identification and Authentication (Organizational Users)

FedRAMP Moderate · 4 controls

AU-12 Audit Record Generation
AU-3 Content of Audit Records
AU-3(1) Additional Audit Information
IA-2 Identification and Authentication (Organizational Users)

PCI DSS 4.0 · 4 controls

10.2.1.1 10.2.1.1 Logs capture individual user access to cardholder data
10.2.1.5 10.2.1.5 Logs capture changes to identification and authentication credentials
10.2.2 10.2.2 Required details recorded for each auditable event
8.2.1 8.2.1 Unique ID assigned to every user

AWS Well-Architected Security Pillar · 3 controls

SEC02-BP02 Use temporary credentials
SEC02-BP04 Rely on a centralized identity provider
SEC04-BP01 Configure service and application logging

SOC 2 · 3 controls

SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials
SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles
ANSSI-HYG-36 Enable and Configure Logging on the Most Important Components

Azure Security Benchmark · 2 controls

IM-1 Use centralized identity and authentication system
LT-3 Enable logging for security investigation

C5 (Germany) · 2 controls

C5-OPS-13 Logging and Monitoring - Identification of Events
C5-OPS-15 Logging and Monitoring - Accountability

CIS Controls v8 · 2 controls

CIS-5.1 Establish and Maintain an Inventory of Accounts
CIS-8.5 Collect Detailed Audit Logs

HIPAA Security Rule · 2 controls

164.312(a)(2)(i) Unique User Identification (Required)
164.312(b) Audit Controls (Standard)

ISO 27701:2019 · 2 controls

6.9.4 Logging and monitoring
7.3.6 Access, correction and/or erasure

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring

NIST SP 800-161 Rev 1 · 2 controls

161R1-AU-10 Non-repudiation
161R1-AU-3 Content of Audit Records

NIST SP 800-171 Rev 3 · 2 controls

03.03.02 Audit Record Content
03.05.01 User Identification and Authentication

NIST SP 800-66 Rev 2 · 2 controls

164.312(a)(2)(i) Unique User Identification (Required)
164.312(b) Audit Controls (Standard)

ACSC Essential Eight · 1 control

E8-ADMIN-ML2 Restrict Administrative Privileges (ML2)

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

ISO/IEC 42001:2023 · 1 control

A.6.2.8 AI system recording of event logs

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of CMMC 2.0 have you already done?

CMMC 2.0 AU.L2-3.3.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CMMC 2.0 your existing evidence covers. Hold FedRAMP Moderate and 108 of 110 CMMC 2.0 controls already carry evidence.

If you hold FedRAMP Moderate98.2% covered · 2 gaps If you hold NIST SP 800-171 Rev 394.5% covered · 6 gaps If you hold NIST SP 800-53 Rev 585.5% covered · 16 gaps If you hold ISO 27001:202279.1% covered · 23 gaps If you hold ISO 27002:202267.3% covered · 36 gaps If you hold CIS Controls v864.5% covered · 39 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 1 were rejected on the FedRAMP Moderate pair alone.

See the released pairs, $299 each Browse the graph free