Audit and Accountability (03.03)

The AU-03.03 control requires organizations to create, retain, and protect audit records that detail user actions, system events, and security-relevant activities, ensuring that logs are sufficient to support traceability, incident response, and compliance verification for Controlled Unclassified Information.