- Any modern log platform's query interface carries the reduction half; verify that exports and summaries are derived views rather than destructive rewrites.
- Time-ordering preservation matters at aggregation — pipelines that re-batch or de-duplicate can silently reorder records.
- Keep one documented example of producing an investigation-ready report; it doubles as the assessor demonstration.
03.03.06OFFICIAL TITLEPENDING NIST SME REVIEW
03.03.06 — Audit Record Reduction and Report Generation
03.03 Audit and Accountability · NIST SP 800-171 Rev. 3
Independent summary of the official requirement
Requires implementing an audit record reduction and report generation capability that supports audit review, analysis, reporting, and after-the-fact investigation, while preserving the original content and time ordering of the audit records.
Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.
NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
When an investigation starts, the raw logs are millions of lines; this requirement wants the ability to filter, search, and summarize them on demand — without altering the originals. Reduction serves the analyst; preservation keeps the record trustworthy as evidence.
Across revisions
Carried from 3.3.6 with preservation of original record content and time ordering made explicit.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- The identified query and reporting capability, with an example report
- Configuration or vendor documentation showing original records are preserved intact
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this came from in Rev. 2
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |