CMMC Level 2 with ARRTECH
Final records an assessor can examine and test.
Evidence for CMMC Level 2 assessment objectives
An assessment examines how requirements are implemented in the contractor’s environment. Logging, collection health and response records help demonstrate the operating process behind the stated controls.
Requirements
| Clause | What it asks | Security support |
|---|---|---|
| AU.L2-3.3.1 | Audit records created and retained. | Events in common categories. → |
| AU.L2-3.3.4 | Alert when audit logging fails. | Alerts on a silent source. → |
| AU.L2-3.3.5 | Correlated audit review. | Correlation across sources. → |
| AU.L2-3.3.8 | Audit information protected. | A signature chain that breaks on change. → |
| IR.L2-3.6.1 | Incident handling in operation. | Cases and playbook run history. → |
| MP.L2-3.8.7 | Removable media controlled. | DLP controls USB devices. → |
Scoping
CMMC scoping considers the SIEM’s security role and any CUI it stores or processes. Describe its sources, dependencies and data flows so the assessment can classify it appropriately.
Objectives
An assessment objective asks a specific question about implementation. Select final records that answer that question, with the relevant systems, period and review history clear to the assessor.
Integrity
An assessor can use a signed SIEM export and independent verification material to check whether the record changed. The source events and collection history explain what the evidence supports.
Completeness
Collection-health monitoring in a SIEM identifies sources that have stopped reporting. Retain the interruption and recovery history so reviews account for the period with incomplete evidence.
Response
An incident record brings together ownership, evidence, decisions and actions. Response workflows in a SOAR can carry out approved procedures and preserve the result of each step, including failures and requests for human approval.
Limits
The following responsibilities belong to the organization’s wider security and governance program. Their owners maintain the evidence needed for review.
170.19(c)(2)(ii)
Responsibilities documented in the SSP and in a customer responsibility matrix.
By rule
Use these references to connect the requirement with relevant operating evidence. The organization defines the scope and implementation being assessed.
AU.L2-3.3.1
Create and retain system audit logs and records, scored objective by objective. A SIEM can retain the relevant sources for the required period and make the history available for review.
AU.L2-3.3.4
Alert in the event of an audit logging process failure. Collection-health monitoring in a SIEM shows when a source stops reporting and helps the team investigate the gap.
AU.L2-3.3.5
Correlate audit record review, analysis and reporting processes. Scheduled SIEM reports organize the relevant records; review findings and follow-up show how the information was used.
AU.L2-3.3.8
Protect audit information and audit logging tools from unauthorized access, modification and deletion. Restricted access, signed records and administrative history support protection and review of the audit trail.
IR.L2-3.6.1
Establish an operational incident-handling capability. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
MP.L2-3.8.7
Control the use of removable media on system components. DLP device policies restrict supported removable media, with approved exceptions and activity retained for review.
Questions
What does the assessor accept?
Assessors examine final evidence relevant to the objective and may also interview staff and test the implementation. A report is most useful when its underlying records and operating context are available.
Can our assessor check the logs without ARRTECH?
Yes. A signed SIEM export includes the verification material and a standalone verifier, allowing an independent check of record integrity.
Is there a ready CMMC report?
No. Any saved query can run as a scheduled report.
Guide
What is CMMC Level 2?
The DoD program that assesses contractor systems holding CUI against the requirements of NIST 800-171 Rev. 2.
What is a Security Protection Asset?
A system that provides security to the assessment scope, such as a SIEM, whether or not it holds CUI.
What is an assessment objective?
A lettered part of a requirement, such as 3.3.1[f]. Each must be met for the requirement to be met.
How ARRTECH takes care of CMMC Level 2 evidence
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
