1Overview
AU.L2-3.3.2 turns audit records into accountability. It requires that the actions of individual users can be uniquely traced to those users, so that when a record shows something happened, it can be tied to a specific person rather than to an anonymous or shared identity. It is a three-point requirement and cannot be deferred on a plan of action.
A log is only as useful as its ability to answer "who." If several people share one account, or actions are recorded against a generic identity, the audit record shows that something occurred but not who did it, and accountability dissolves. This control depends on the individual identity established in the identification and authentication family, and it requires that audit records carry enough to trace an action to the individual responsible. Where 3.3.1 ensures records exist and carry content, this control ensures that content includes an identity specific enough to hold a person accountable.
Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
The key word is "uniquely." The requirement is defeated by shared accounts, where several people act under one identity, and by generic administrative logins that no single person owns. Unique traceability means each recorded action carries an individual identity, so the audit trail can attribute it to one person. The three-point weight reflects that accountability is what gives auditing its deterrent and investigative power.
2The Assessment Objectives
NIST SP 800-171A frames 3.3.2 around two objectives: define the content needed for traceability, and ensure records carry it.
The content of audit records needed to support the ability to uniquely trace users to their actions is defined. The organization has decided what each record must contain to identify the individual.
Audit records, once created, contain the defined content. The records actually carry the individual identity that allows tracing.
The two objectives are the definition of traceable content and its presence in the records. The common gap is at objective [b] wherever shared accounts persist, since a record tied to a shared identity cannot uniquely trace an action. The assessor looks for records that resolve to individuals, which depends on individual accounts throughout.
3Failure Patterns
The failures are about shared and generic identities that break the link between an action and a person.
Shared accounts on the floor
A workstation or application login shared by a shift defeats unique traceability, because the record shows the shared account and not the individual. This is the most common failure of the control, and it is resolved by giving each person an individual account, which ties this control to the identification and authentication family.
Generic administrator logins
Where administrators act under a shared privileged account, their actions cannot be traced to the individual who performed them. Named administrative accounts, or individual accounts elevated to privilege, restore the traceability that a generic administrator login destroys.
Service or default accounts used by people
When people log in with a service account or a vendor default, actions are recorded against a non-person, and accountability is lost. Reserving such accounts for their intended non-interactive use and requiring individuals to act under their own identity keeps records traceable.
Records that omit identity
Even with individual accounts, records that do not capture the user field fail objective [b]. The defined content has to include the individual identity, and the records have to actually carry it.
4Ownership
This is an IT-owned control that rests on individual identity, so its main work overlaps with account management in the identification and authentication family.
| Role | Responsibility for this control |
|---|---|
| IT and system administrator | Ensures records capture individual identity and eliminates shared accounts so actions trace to people. Owns the technical evidence. |
| Security or compliance lead | Defines the record content needed for traceability and confirms records resolve to individuals. |
| Department supervisors | Support the end of shared logins on the floor, since shared accounts usually persist as a workflow convenience that has to be replaced with individual ones. |
5Tooling
The control is delivered by individual accounts and by audit records that capture the user, so tooling overlaps with directory account management and audit configuration.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a] | Audit content configuration including user identity | Record content defined to capture the individual for each action. |
| [b] identity | Individual directory accounts, named administrative accounts | The individual identities that let records trace to one person, replacing shared logins. |
| [b] capture | Logon and action auditing tied to the account | Records that actually carry the individual user for each event. |
| Verification | Review for shared and generic accounts | Detection of remaining shared identities that would break traceability. |
The caveat is that traceability is only as good as the individuality of the accounts. Perfect audit configuration cannot trace a shared account to a person, so the real work is often eliminating shared logins rather than tuning the logs. The assessor tests traceability by asking whether a given action can be tied to one individual, so shared accounts have to be gone for the records to answer.
6Evidence
The satisfied version of 3.3.2 shows records that resolve individual actions to individual users.
| Evidence | What it demonstrates |
|---|---|
| Audit content definition | Objective [a]. The record content defined to include individual identity. |
| Sample records with user identity | Objective [b]. Records that carry the individual for each action. |
| Individual account confirmation | Objective [b]. Evidence that shared accounts are eliminated so records resolve to people. |
The evidence should demonstrate that an action in the logs can be traced to one person, which rests on individual accounts as much as on the record content. Sample records showing individual identity, paired with confirmation that shared logins are gone, is the clearest demonstration of the control.
A shared login has no one to hold accountable
Unique traceability breaks the moment a shift shares a workstation account, and no amount of logging can name the person behind a shared identity. Replacing shared logins with individual accounts so the audit trail resolves to people is part of the onsite readiness work this practice does, and it is one of the controls that must be met rather than deferred.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.3.2. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.3.2[a] and 3.3.2[b]. csrc.nist.gov
- 32 CFR 170.24, CMMC Scoring Methodology, listing AU.L2-3.3.2 among the three-point basic security requirements. ecfr.gov