Event Logging is the first requirement in the Audit and Accountability (03.03) family, and it is where you decide what your systems will log. It does not generate the records itself, that is Audit Record Generation (03.03.03), and it does not define their content, that is Audit Record Content (03.03.02). Event Logging (03.03.01) specifies the event types selected for logging and requires you to review and update that selection over time. Per the NIST discussion, an event is any observable occurrence in a system, and organizations identify the event types for which logging is needed to meet their security and auditing requirements, such as password changes, execution of privileged functions, failed logons, administrative privilege usage, or third-party credential usage.
A common difficulty with this requirement is logging everything the tool ships with and never documenting the decision. The requirement is that you specify the event types, tied to an Organization-Defined Parameter (ODP), and then review and update that set on a defined frequency. For Department of Defense (DoD) contractors, the event types are not left open: DoD publishes a detailed minimum list. Leaving the selection at vendor defaults, or never reviewing it, leaves objectives unmet.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.03.01 Event Logging. Only the formatting has been adjusted for readability. This requirement has two (2) lettered parts:
The source control is AU-02 from NIST 800-53. The two bracketed assignments are the Organization-Defined Parameters (ODPs): the event types to log and the review frequency. Per the NIST discussion, organizations balance monitoring and auditing needs against system performance, for example by having the capability to log every file access but only activating it under specific circumstances, and the set of logged event types is expected to change over time. You can read the requirement directly at NIST 800-171 R3, 03.03.01 (p. 21).
Two (2) values sit inside this requirement. Depending on your contract, your organization may be permitted to define them. Organizations in the DIB subject to CMMC are not, because the DoD has defined them as policy.
The values below come from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.
The assigned value for 03.03.01.a, quoted from the memo:
at a minimum and where applicable: 1) Authentication events: a) Logons (Success/Failure), b) Logoffs (Success); 2) Security Relevant File and Objects events: a) Create (Success/Failure), b) Access (Success/Failure), c) Delete (Success/Failure), d) Modify (Success/Failure), e) Permission Modification (Success/Failure), f) Ownership Modification (Success/Failure); 3) Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure); 4) Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure); 5) User and Group Management events: a) User add, delete, modify, disable, lock (Success/Failure), b) Group/Role add, delete, modify (Success/Failure); 6) Use of Privileged/Special Rights events: a) Security or audit policy changes (Success/Failure), b) Configuration changes (Success/Failure); 7) Admin or root-level access (Success/Failure); 8) Privilege/Role escalation (Success/Failure); 9) Audit and security relevant log data accesses (Success/Failure); 10) System reboot, restart, and shutdown (Success/Failure); 11) Print to a device (Success/Failure); 12) Print to a file (e.g., pdf format) (Success/Failure); 13) Application (e.g., Adobe, Firefox, MS Office Suite) initialization (Success/Failure)
The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.
NIST 800-171A R3 breaks 03.03.01 into five (5) assessment objectives: two (2) Organization-Defined Parameters (ODPs) and three (3) determination statements. These AOs are:
The determination statements split part b into a review objective and an update objective, so reviewing the event types without ever updating them leaves an objective open. If you are a DoD contractor, the ODPs are specified. Per the DoD-specified ODP values in ComplianceForge's NIST 800-171 R3 Transition Guide, the event types (ODP[01]) are a detailed minimum list covering, where applicable, authentication events (logons and logoffs), security-relevant file and object events (create, access, delete, modify, and permission and ownership changes), exports and imports to and from removable media, user and group management, use of privileged or special rights including security, audit, and configuration changes, administrator or root access, privilege or role escalation, audit and security log accesses, system reboot and shutdown, printing to a device or file, and application initialization, each recorded for success and failure. DoD points to Office of Management and Budget (OMB) Memorandum M-21-31, Maturity Level 1, for additional guidance. The review-and-update frequency (ODP[02]) is at least every twelve (12) months and after any significant incidents or significant changes to risks. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.03.01 (p. 25).
Examine: audit and accountability policy and procedures; procedures for auditable events; system design documentation; system configuration settings; system audit records; system auditable events; system security plan.
Interview: personnel with audit and accountability responsibilities; personnel with information security responsibilities; system administrators.
Test: mechanisms for implementing system auditing.
03.03.01 maps from NIST 800-171 R2 requirement 3.3.1 (create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity), and it draws on R2 requirement 3.3.3 (review and update logged events):
Mapped against the five (5) AOs, three (3) are direct (minimal effort), one (1) is indirect (moderate effort), and one (1) has no clear mapping (significant effort), with none net new. The specify-and-review concept carries forward, but the review-and-update frequency parameter has no R2 predecessor, so define it deliberately.
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.03.01 through the following SCF controls:
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
The following are issues teams may encounter rather than certainties. They are about the event-type selection and the review cycle, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.03.01 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.03.01 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
Alongside these, keep the System Security Plan (SSP) narrative for 03.03.01 recording the ODP values you adopted.
With three (3) AOs mapping directly, one indirectly, and one with no clear mapping, 03.03.01 is a moderate lift, front-loaded on defining the event types. A realistic sequence:
What value does the DoD require for the first parameter in NIST 800-171 R3 03.03.01? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.03.01.a: at a minimum and where applicable: 1) Authentication events: a) Logons (Success/Failure), b) Logoffs (Success); 2) Security Relevant File and Objects events: a) Create (Success/Failure), b) Access (Success/Failure), c) Delete (Success/Failure), d) Modify (Success/Failure), e) Permission Modification (Success/Failure), f) Ownership Modification (Success/Failure); 3) Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure); 4) Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure); 5) User and Group Management events: a) User add, delete, modify, disable, lock (Success/Failure), b) Group/Role add, delete, modify (Success/Failure); 6) Use of Privileged/Special Rights events: a) Security or audit policy changes (Success/Failure), b) Configuration changes (Success/Failure); 7) Admin or root-level access (Success/Failure); 8) Privilege/Role escalation (Success/Failure); 9) Audit and security relevant log data accesses (Success/Failure); 10) System reboot, restart, and shutdown (Success/Failure); 11) Print to a device (Success/Failure); 12) Print to a file (e.g., pdf format) (Success/Failure); 13) Application (e.g., Adobe, Firefox, MS Office Suite) initialization (Success/Failure).
How many assessment objectives does NIST 800-171 R3 03.03.01 have? NIST 800-171A R3 breaks 03.03.01 into five (5) assessment objectives: two (2) Organization-Defined Parameters (ODPs) and three (3) determination statements. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.03.01 come from? AU-02.
Where does NIST 800-171 R3 03.03.01 sit in the NIST 800-171 R3 Kill Chain? Phase 11, Situational Awareness (SA). The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
03.03.01 Event Logging specifies the event types your systems log and requires you to review and update that selection. It maps from R2 3.3.1 and draws on 3.3.3, with three (3) objectives transitioning directly, one indirectly, and one review-frequency parameter that has no clear R2 mapping. The recurring problem is accepting vendor default logging and never reviewing it. Define your event types (for DoD, the specified minimum list and OMB M-21-31 Maturity Level 1), set the review frequency, specify the events for logging, and run a review-and-update cycle with dated records.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
