Skip to content
ControlVerdict
Sign in
AU.L2-3.3.6CMMC Level 2Level 2

Reduction & Reporting

Submit your own example

Practice statement

Provide audit record reduction and report generation to support on-demand analysis and reporting.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.3.6.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    an audit record reduction capability that supports on-demand analysis is provided; and

    1 example covers this

  2. [b]

    a report generation capability that supports on-demand reporting is provided.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    AU.L2-3.3.6Reduction & Reporting
    Provide audit record reduction and report generation to support on-demand analysis and reporting.

    • [a]

      an audit record reduction capability that supports on-demand analysis is provided; and

    • [b]

      a report generation capability that supports on-demand reporting is provided.

    Saved searches and a scoped assessor report instead of multi-gigabyte CSV dumps

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Reduction & Reporting objectives: an audit record reduction capability supporting on-demand analysis, and a report generation capability supporting on-demand reporting.

    Reduction [a]. Analysts work through saved searches with parameters for time range, user, host, and event class, so a question like what did this account do in the enclave last Tuesday is a form to fill in rather than a query to write. Summary indexes pre-aggregate the high-volume sources (authentication outcomes per account per hour, file-share read volume per user per day) so a multi-month question returns in seconds instead of scanning raw events.

    Reporting [b]. A report library covers the questions we are actually asked: privileged activations with ticket reconciliation, failed authentication trends, enclave file-share access by user, silent-source history, and log-admin activity. Each renders on demand and exports to PDF or CSV with the query, the time range, and the run timestamp printed on it, so a reviewer can see how the numbers were produced.

    Scoping matters. Reports are scoped to the enclave systems in the assessment boundary. Exports land on an access-controlled evidence share with a retention date, and anything containing CUI-adjacent detail is marked and handled accordingly rather than emailed.

    Maintenance. Quarterly test that each report in the library still runs after schema or platform changes. Report definitions are version-controlled with the query text, so a report can be re-run against a past window and reproduce the same result.

    Accepted gap. One source is queried through a slower archive tier, so its reports run as a scheduled job rather than truly on demand; requests against that source are answered within one business day, and the constraint is stated up front instead of discovered mid-assessment.

    What the evidence looks like

    • Saved search library with parameter definitions
    • Summary index or aggregation configuration for the high-volume sources
    • Sample generated report showing query, time range, and run timestamp
    • Evidence share permissions and retention settings
    • Quarterly report-validation checklist

    Environment

    Preparing for a third-party assessment after a prior cycle where evidence requests were answered with raw exports nobody could read.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.