AU.L2-3.3.6 — Provide audit record reduction and report generation to support on-demand analysis and reporting.

What this control requires

Provide audit record reduction and report generation to support on-demand analysis and reporting.

Source: CMMC L2 v2.13 AU.L2-3.3.6 / NIST SP 800-171 R2 3.3.6 (official control text).

Why this matters

Raw audit logs are overwhelming noise unless you can filter, aggregate, and report on them. This control requires the organization to implement tooling that transforms thousands of log entries into actionable summaries — identifying failed login patterns, privilege escalations, or access anomalies. Without reduction and reporting capabilities, security teams drown in data and miss real incidents. Effective log analysis turns compliance evidence into operational intelligence, enabling rapid investigation when breaches occur and demonstrating to assessors that the organization actively monitors its environment rather than passively collecting logs.

What evidence assessors expect

Assessors typically look for: screenshot, PDF, configuration export. FORCE coaches you through the exact implementation steps and captures each artifact in-platform.

Related controls