CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.3.2Tie actions to individuals in Rev. 3

Reworded: 03.03.02 Audit Record Content.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

Side by side

Rev. 2 · in force 3.3.2 User Accountability

Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Assessment objectives · 800-171A

  1. [a] the content of the audit records needed to support the ability to uniquely trace users to their actions is defined
  2. [b] audit records, once created, contain the defined content

Rev. 3 · not adopted 03.03.02 Audit Record Content

a. Include the following content in audit records:

01. What type of event occurred

02. When the event occurred

03. Where the event occurred

04. Source of the event

05. Outcome of the event

06. Identity of the individuals, subjects, objects, or entities associated with the event

b. Provide additional information for audit records as needed.

Determination statements · 800-171A Rev. 3

  1. 03.03.02.a.01 audit records contain information that establishes what type of event occurred.
  2. 03.03.02.a.02 audit records contain information that establishes when the event occurred.
  3. 03.03.02.a.03 audit records contain information that establishes where the event occurred.
  4. 03.03.02.a.04 audit records contain information that establishes the source of the event.
  5. 03.03.02.a.05 audit records contain information that establishes the outcome of the event.
  6. 03.03.02.a.06 audit records contain information that establishes the identity of the individuals, subjects, objects, or entities associated with the event.
  7. 03.03.02.b additional information for audit records is provided, as needed.

Draws on Rev. 2 3.3.2.

Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.

Word by word

The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.

removed in Rev. 3 added in Rev. 3

Rev. 2 3.3.2 → Rev. 3 03.03.02 Audit Record Content

Ensure that Include the actions following content in audit records: What type of individual system users can be uniquely traced to those users so they can be held accountable event occurred When the event occurred Where the event occurred Source of the event Outcome of the event Identity of the individuals, subjects, objects, or entities associated with the event Provide additional information for their actions. audit records as needed.

3 words kept, 21 removed, 45 added. Rev. 3 statement labels omitted for the comparison.

What NIST says changed

  • New security requirement title
  • Aligned with SP 800-53, Rev 5 to provide more comprehensive detail on and foundational tasks for audit record content

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Significant change”. At adoption, Bedrock files this under “Rework”.

NIST's Rev. 3 discussion for 03.03.02

Audit record content that may be necessary to support the auditing function includes time stamps, source and destination addresses, user or process identifiers, event descriptions, file names, and the access control or flow control rules that are invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). Detailed information that organizations consider in audit records may include a full text recording of privileged commands or the individual identities of group account users.

What this means for you now

Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.3.2 as written in Rev. 2.

Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.

Back to the Rev. 2 vs Rev. 3 overview

Where this page's facts come from
Rev. 2 text and objectives
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Mapping and change class
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Rev. 3 03.03.02
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]