If there's one area where small contractors quietly fall short, it's audit logging. Not because it's hard, but because "we have logs" feels like enough — and it isn't. The NIST 800-171 audit family (3.3) is really asking four things: log the right events, keep them, protect them, and look at them. Here's the family in plain English.
What the 3.3 family actually requires
| Control | In plain English |
|---|---|
| 3.3.1 (5 pts) | Create and retain the logs you need to investigate activity — across the whole in-scope environment. |
| 3.3.2 | Tie every logged action to a specific person (no shared accounts). |
| 3.3.3 | Periodically review and update what you log. |
| 3.3.4 | Alert if logging itself fails. |
| 3.3.5 (5 pts) | Correlate and review the logs to spot suspicious activity — actually use them. |
| 3.3.6 | Be able to search logs and generate reports on demand. |
| 3.3.7 | Sync system clocks so time stamps line up. |
| 3.3.8 | Protect logs and logging tools from tampering or deletion. |
| 3.3.9 | Limit who can manage the logging functions. |
Why teams fail it
Three patterns show up again and again:
- Partial coverage. Logging is on for the domain controller but not the file server, or the firewall but not the endpoints. The requirement is the whole in-scope environment.
- No retention. Logs roll over in a few days. If you can't produce 90 days (or whatever your policy says) during an investigation, you don't really have audit logs.
- Nobody looks. The two 5-point controls here (3.3.1 and 3.3.5) reward generating and reviewing logs. Storage without review protects no one — and assessors ask to see your review process.
The straightforward fix
You don't need an enterprise SOC. A small contractor can satisfy the whole family with a sensible setup:
- Centralize. Ship logs off each system into one place (a SIEM, or your cloud platform's log analytics). Central collection covers coverage, protection (3.3.8), and reporting (3.3.6) in one move.
- Set retention. Define how long you keep logs in policy, and configure storage to match.
- Restrict + protect. Make sure the people generating logs can't delete them, and limit who manages logging (3.3.8 / 3.3.9).
- Sync clocks. Point everything at an authoritative NTP source (3.3.7).
- Review on a cadence. Even a documented weekly review with notes satisfies the "actually look" requirement — and an alert when logging breaks (3.3.4) closes the loop.
See what audit logging is worth to your score
3.3.1 and 3.3.5 are 5-point controls. Run all 110 free and see where the audit family puts your number.
Calculate your SPRS score →Start here
Centralize your logs, set retention, restrict access, sync clocks, and review on a cadence — that's the whole family. Score yourself, then document it in your SSP. Both tools are free.