- Put the review on a calendar with a named owner; 'we will revisit logging when we have time' is the failure mode the requirement targets.
- Feed the review from real events: every investigation that came up short on evidence is a concrete input to what should be logged next.
3.3.3OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.3.3 — Logged event review
3.3 Audit and Accountability · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Review and update logged events.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
The list of events you log is a decision, and decisions go stale. This requirement makes you revisit that list on a cadence — after an investigation that lacked the record it needed, or a new system that arrived logging nothing — and update it.
Across revisions
Not carried as a standalone requirement in Rev. 3; the periodic review and update of selected event types is an explicit part of Event Logging, 03.03.01.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- A dated review record showing which event selections were examined and what changed
- Configuration change history for logging settings tying updates back to the review
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |