Valontir

NIST 800-171 · Audit and Accountability

Requirement 3.3.2

SPRS weight
SPRS weight: 3
POA&M eligibility
Not POA&M-eligible
Assessment objectives
2 assessment objectives

Official requirement text

Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.

Assessment objectives

Assessors don’t evaluate the requirement as one sentence; they walk these objectives one by one. Each must be met for the requirement to score.

  1. 3.3.2[a]the content of the audit records needed to support the ability to uniquely trace users to their actions is defined.
  2. 3.3.2[b]audit records, once created, contain the defined content.

Inside Valontir, this requirement carries a full plain-English guide: what it asks in normal words, what good looks like in a small shop, the evidence an assessor accepts, the common gaps that cost points, and a plain reading of every assessment objective shown above. See it in a demo.