3.3 Audit and Accountability: the NIST SP 800-171 requirements

Enable audit logging on domain controllers, servers, firewalls, VPN, and cloud tenants (Microsoft 365 unified audit log is often off by default: turn it on today), and ship logs to central storage with retention of at least 90 days online and one year archived. A low-cost SIEM or log platform (Microsoft Sentinel, Wazuh, Graylog) fits small-contractor budgets. Document which event types you log and why. Evidence: the logging standard, retention configuration, and a sample query pulling events across sources.

Eliminate shared and generic logons so every action traces to a person: give each user and each admin a uniquely named account, and where shared service accounts are unavoidable, restrict them to non-interactive use. Verify your logs actually capture username on key events. Evidence: account listing showing no shared interactive accounts and sample log entries tied to named individuals.

Schedule a periodic (at least annual) review of which event types you log, adjusting for new systems, new threats, and gaps found during incidents, and record the outcome even when the conclusion is "no change." This is a lightweight documented process, not a tool purchase. Evidence: the review procedure and dated meeting notes or tickets showing the reviews occurred.

Configure alerts for logging failures: SIEM heartbeat/agent-offline alerts, disk-space thresholds on log volumes, and notifications when a log source goes silent. Define in writing who receives the alert and what they do. Most SIEMs can do this with a built-in rule, making it a same-day fix once central logging exists. Evidence: the alert rule configuration and a test alert with the response documented.

Bring your key log sources into one place where they can be reviewed together: a SIEM correlating firewall, identity, and endpoint events, or at minimum a documented weekly review that examines them side by side. Enable built-in correlation/analytics rules (impossible travel, brute force followed by success) as quick wins. Evidence: the SIEM data source list, enabled correlation rules, and dated review notes.

Provide the ability to filter and summarize audit data on demand: saved SIEM queries, dashboards, or scheduled reports that reduce raw logs to reviewable summaries (failed logons by user, admin actions by system). Build a handful of saved searches for your most common investigation questions. Evidence: screenshots of the saved queries/dashboards and a sample generated report.

Point all systems at an authoritative time source: domain-joined machines sync to the domain controller, which syncs to NTP (e.g., NIST or pool servers); configure network gear and standalone hosts to the same source. Spot-check clock drift across systems as verification. This is usually a one-hour configuration task. Evidence: NTP configuration on the DC and network devices, and log samples showing consistent timestamps.

Restrict access to log storage and SIEM consoles to a named security/admin group, make collected logs append-only or forward them off-host so a compromised system's attacker cannot erase their tracks, and enable immutability or retention locks where your platform supports them. Evidence: ACLs on log repositories, SIEM role assignments, and retention/immutability settings.

Limit who can change audit policy, clear logs, or administer the SIEM to a small named subset of your privileged users: ideally different people than those being audited, or with alerting on audit-config changes as a compensating measure in tiny teams. Evidence: the SIEM admin role membership list and GPO/permission settings restricting audit policy changes.