# NIST 800-171 3.3.6 Provide audit record reduction and report generation to support on-demand analysis and reporting.

- Source: https://support.icompaas.com/support/solutions/articles/62000229276-nist-800-171-3-3-6-provide-audit-record-reduction-and-report-generation-to-support-on-demand-analysis
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Audit record reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit record reduction and report generation capabilities do not always emanate from the same system or organizational entities conducting auditing activities. Audit record reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the system can help generate customizable reports. Time ordering of audit records can be a significant issue if the granularity of the time stamp in the record is insufficient. 

  

**Priority**: Medium

  

**Category**:   Situational Awareness 

  

**Services Associated with AWS:**   

-   AWS CloudTrail, AWS Identity and Access Management (IAM), AWS Security Hub  
    

  

**Objective Evidence:**  

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screen shot of report from SIEM

  

Possible Technology Considerations : 

-   Centralized Log Management
-   Security Information & Event Management (SIEM)  
    

  

**What needs to be answered :**  

Is there the capability to process audit records for events of interest based on selectable event criteria, such as user identity, event type, location, times, dates, system resources, IP, or information object accessed? Can this be done on-demand? 

  

-   Implement Audit Record Reduction Capability  
    Description: This check ensures that organizations have implemented audit record reduction capabilities to manipulate and summarize collected audit information in a format that is more meaningful for analysis and reporting purposes. Audit record reduction techniques, such as data mining and advanced data filters, are utilized to identify anomalous behavior and extract relevant insights from the audit records. This capability enables analysts to efficiently analyze the audit data and identify potential security incidents.
-   Enable Customizable Report Generation  
    Description: This check verifies that organizations have implemented the capability to generate customizable reports based on the reduced audit records. The report generation functionality allows analysts to generate reports tailored to specific requirements, including selecting desired data elements, applying filters, and organizing the information in a format that facilitates analysis and reporting. Customizable reports enhance the effectiveness of on-demand analysis and reporting activities.
-   Address Time Ordering Challenges in Audit Records  
    Description: This check ensures that organizations address challenges related to time ordering in audit records by employing appropriate mechanisms to maintain accurate and granular timestamps. Time ordering is critical for effective analysis and investigation of security incidents. Organizations implement measures to ensure that the timestamps in audit records provide sufficient granularity and accuracy, enabling the proper sequencing of events and facilitating chronological analysis.  
    

  

**More Details:**   

Monitoring software capable of on demand and scheduled report generation of system activity.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.