# NIST 800-171 3.3.3 Review and update logged events.

- Source: https://support.icompaas.com/support/solutions/articles/62000229273-nist-800-171-3-3-3-review-and-update-logged-events-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

The intent of this requirement is to periodically re-evaluate which logged events will continue to be included in the list of events to be logged. The event types that are logged by organizations may change over time. Reviewing and updating the set of logged event types periodically is necessary to ensure that the current set remains necessary and sufficient. 

  

**Priority**: High 

  

**Category**:  Situational Awareness 

  

**Services Associated with AWS:**  

-   AWS CloudTrail, AWS Identity and Access Management (IAM), AWS Security Hub  
    

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screen shot of configuration settings
-   Technical: screen shot of logs from SIEM

  

Possible Technology Considerations : 

-   Centralized Log Management
-   Security Information & Event Management (SIEM)  
    

  

**What needs to be answered :**  

Does the company review and update audited events annually or in the event of substantial system changes or as needed? Is the list of audited events reviewed by company management and updated on a regular  
basis? 

  

-   Periodically Review and Update Logged Events  
    Description: This check ensures that organizations periodically review and update the set of event types that are logged. The purpose is to re-evaluate the logged events and determine if any changes are needed based on evolving security requirements, technological advancements, and organizational needs. The review ensures that the set of logged event types remains necessary and sufficient to effectively monitor, analyze, investigate, and report on system activity.
-   Assess the Relevance and Effectiveness of Logged Events  
    Description: This check verifies that organizations assess the relevance and effectiveness of the logged events on a regular basis. The assessment considers factors such as changing security threats, emerging attack vectors, regulatory requirements, and organizational priorities. Based on the assessment, organizations update the set of logged event types to ensure that it aligns with the current security landscape and provides adequate coverage for monitoring and incident response purposes.
-   Document and Maintain Event Logging Updates  
    Description: This check ensures that organizations document and maintain records of updates made to the set of logged event types. The documentation includes the rationale for the updates, the date of the update, and the individuals or teams responsible for the decision. By maintaining a record of event logging updates, organizations can demonstrate their commitment to continuously improving their logging practices and adapting to changing security requirements.

  

**More Details:**   

Regular review and update of audited events performed by company COO and IT staff.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.