Audit and Accountability Policy
Defines how Your Organization generates, protects, and reviews audit logs so that security-relevant events are traceable to an individual, detectable in a timely manner, and preserved for investigation.
Maps to CMMC Level 2 AU.L2-3.3.1 · CMMC Level 2 AU.L2-3.3.3 · CMMC Level 2 AU.L2-3.3.8
Read it now — the PDF opens either way.
Purpose
When something goes wrong, Your Organization needs to be able to answer what happened, when, and who or what caused it. This policy defines how Your Organization generates, protects, and reviews audit logs across its information systems so that security-relevant events are traceable to an individual or process, detectable in a timely manner, and preserved for investigation.
Scope
This policy applies to all Your Organization information systems that store, process, or transmit company or customer data, including applications, infrastructure, identity systems, network devices, and the logging and monitoring platforms that aggregate their output.
8 more sections in the full template
What is logged · Time synchronization · Log protection · Log review · Log aggregation and correlation · Retention · Roles and responsibilities · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Audit and Accountability Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.