When assessing a contractor’s implementation of CMMC practices, you examine its SystemSecurity Plan (SSP) to identify its documented measures for…

The CMMC practice AU.L2-3.3.6 requires the organization to "Provide an audit reduction and report generation capability that supports on-demand analysis and reporting." This practice has two distinct components: audit reduction and report generation. Option C directly addresses both. "Filter rules for reducing audit logs" corresponds to the audit reduction capability, which organizes vast amounts of log data into a more meaningful summary. The capability to "analyze large volumes of log files... identifying anomalies and summarizing the data... generating customized reports" directly corresponds to the report generation and on-demand analysis requirement. Splunk, as a Security Information and Event Management (SIEM) tool, is specifically designed to perform these functions using its powerful search, filtering, and reporting features.

A. This relates to access control for the logging system, which is covered by other practices such as AC.L2-3.1.5 and AU.L2-3.3.4 (Protect audit information), not the reduction and reporting capability itself.

B. Audit record retention is a separate requirement addressed by CMMC practice AU.L2-3.3.3, which specifies the need to meet defined retention requirements, not the analysis and reporting of that data.

D. While a compliance dashboard is a useful outcome, it is a specific application of the reporting capability. The core practice assesses the underlying capability to reduce, analyze, and generate reports on demand, which is more accurately described in C.

1. NIST Special Publication 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, December 2020.

Section 3.3.6 (Page 21): States the requirement, "Provide an audit reduction and report generation capability that supports on-demand analysis and reporting." The discussion clarifies, "Audit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. Audit report generation is the process of formatting and organizing collected audit information into a presentable format." This directly supports the description in option C.

2. CMMC Model Version 2.0, CMMC Level 2 Assessment Guide, Department of Defense, December 2021.

Practice AU.2.044 (Page 41): The assessment objectives for this practice are "[a] an audit reduction capability is provided; [b] a report generation capability is provided; and [c] the audit reduction and report generation capability supports on-demand analysis and reporting." Option C explicitly describes the features that would satisfy all three objectives.

3. NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, September 2020.

Control AU-7, Audit Reduction and Report Generation (Page 168): The control states, "Employ audit reduction and report generation tools to support on-demand analysis and reporting." The discussion section provides the same definition of audit reduction and report generation as NIST SP 800-171, reinforcing that the focus is on tools that can manipulate, summarize, and format audit data for analysis.

4. Splunk Enterprise Documentation, Search Manual.

Chapter: "About searching in Splunk Web": This official documentation details how Splunk's Search Processing Language (SPL) is used to "filter out unwanted events," "extract more information," and "transform the data into tables and visualizations," which are the core technical functions described in option C for audit reduction and reporting.