# CMMC 2.0 AU.3.051 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

- Source: https://support.icompaas.com/support/solutions/articles/62000229436-cmmc-2-0-au-3-051-correlate-audit-record-review-analysis-and-reporting-processes-for-investigation-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CMMC](https://support.icompaas.com/support/solutions/62000112530) › [2.0](https://support.icompaas.com/support/solutions/folders/62000168778)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Level 2**

  

**Description:**

Correlating audit record review, analysis, and reporting processes helps to ensure that they do not operate independently, but rather collectively. Regarding the assessment of a given organizational system, the requirement is agnostic as to whether this correlation is applied at the system level or at the organization level across all systems.  

  

**Priority:** High 

  

**Domain: AUDIT AND ACCOUNTABILITY (AU)** 

  

**Services Associated with AWS:** 

-   AWS CloudTrail, AWS Identity and Access Management (IAM), AWS Security Hub

  

**Services Associated with Azure:**

-   Azure Sentinel
-   Azure Log Analytics
-   Azure Monitor

  

Objective Evidence: 

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation of role-based security training being performed
-   Administrative: supporting documentation of professional competence by individual(s) performing log reviews
-   Administrative: supporting documentation of log reviews being performed
-   Technical: screen shot of logs from SIEM

  

Possible Technology Considerations:

-   Centralized Log Management
-   Security Information & Event Management (SIEM) 

  

**What needs to be answered:**

Are mechanisms used to integrate audit review, analysis, and reporting to processes for investigation and response to suspicious activity? 

  

**Checks for AWS**

-   Implement Correlation of Audit Record Review, Analysis, and Reporting Processes  
    Description: This check verifies that organizations have implemented processes to correlate the review, analysis, and reporting of audit records for effective investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. Correlation involves combining information from multiple audit records and sources to identify patterns, anomalies, and potential security incidents. The correlated data aids in understanding the context and scope of security events, enabling timely and appropriate actions to be taken.
-   Establish Incident Response Procedures for Correlated Audit Events  
    Description: This check ensures that organizations have established incident response procedures that include specific steps for addressing correlated audit events. Incident response procedures define the actions, roles, responsibilities, and communication channels required to investigate and respond to security incidents identified through the correlation of audit records. These procedures facilitate a coordinated and timely response to mitigate the impact of security events and restore normal operations.
-   Document and Maintain Correlation Processes and Procedures  
    Description: This check ensures that organizations document and maintain the processes and procedures for correlating audit record review, analysis, and reporting. The documentation includes the methodology, tools, and techniques used for correlation, as well as the roles and responsibilities of individuals involved in the process. By maintaining up-to-date documentation, organizations can ensure consistency and effectiveness in their efforts to identify and respond to security incidents through correlated audit records. 

  

**Checks for Azure**

-   Implement Correlation of Audit Record Review, Analysis, and Reporting Processes in Azure:  
    Description: This check ensures that organizations in Azure have implemented processes to correlate the review, analysis, and reporting of audit records for effective investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. Correlation involves combining information from multiple audit records and sources to identify patterns, anomalies, and potential security incidents. The correlated data aids in understanding the context and scope of security events, enabling timely and appropriate actions to be taken.
-   Establish Incident Response Procedures for Correlated Audit Events in Azure:  
    Description: This check verifies that organizations in Azure have established incident response procedures that include specific steps for addressing correlated audit events. Incident response procedures define the actions, roles, responsibilities, and communication channels required to investigate and respond to security incidents identified through the correlation of audit records. These procedures facilitate a coordinated and timely response to mitigate the impact of security events and restore normal operations.
-   Document and Maintain Correlation Processes and Procedures in Azure:  
    Description: This check ensures that organizations in Azure document and maintain the processes and procedures for correlating audit record review, analysis, and reporting. The documentation includes the methodology, tools, and techniques used for correlation, as well as the roles and responsibilities of individuals involved in the process. By maintaining up-to-date documentation, organizations can ensure consistency and effectiveness in their efforts to identify and respond to security incidents through correlated audit records.

  

**More Details:** Monitoring systems capable of allowing audit review and report analysis.

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.