UTMStack

Articles, updated 11 min read

CMMC SIEM Requirements: Does Level 2 Need a SIEM? (2026 Guide)

By UTMStack Team

If you are preparing for a CMMC Level 2 assessment, you have probably been told you “need a SIEM”. The rule never says that. What it does require is a set of audit logging and monitoring practices that are very hard to meet without one once you have more than a handful of systems. This guide explains exactly what CMMC asks for, which of those requirements carry the most weight in your score, and what to check before you pick a SIEM, including the question everyone asks about cloud SIEMs and FedRAMP.

The short answer: CMMC does not require a product called a SIEM. Level 2 requires the 110 security requirements of NIST SP 800-171 Revision 2, and its Audit and Accountability family asks you to create and keep logs, tie actions to individual users, alert when logging fails, correlate log review across systems, and produce reports on demand. Requirement 3.3.5 (correlation) is worth 5 points and cannot be deferred to a plan of action. For most contractors, a SIEM is the practical way to meet it.

Where CMMC stands in late 2026

  • The program rule (32 CFR Part 170) took effect on December 16, 2024.
  • The contract rule (DFARS 252.204-7021, from 48 CFR) took effect on November 10, 2025. That started Phase 1: Level 1 or Level 2 self-assessments as a condition of award.
  • Phase 2 was due on November 10, 2026, when third-party Level 2 certification (by a C3PAO) would have become a condition of award. On July 13, 2026 the Department’s Chief Information Officer suspended that step. A class deviation (2026-O0025) now tells contracting officers to require only Level 1 (Self) or Level 2 (Self) assessments, to keep baseline compliance with NIST SP 800-171 Revision 2 under DFARS 252.204-7012, and to remove the Phase 2 requirements from solicitations and contracts. As of October 2026, no new date has been announced.

The CMMC rollout so far

Phase 2 was suspended before it started; self-assessments and NIST SP 800-171 still apply

  1. Dec 16, 2024Program rule in force32 CFR Part 170
  2. Nov 10, 2025Phase 1Level 1 or Level 2 self-assessments in contracts
  3. Jul 13, 2026Phase 2 suspendedThe planned November 2026 move to third-party Level 2 certification is on hold
  4. NextNo new date yetContracts may require only self-assessments for now

The suspension changes who checks your work, not what you have to do. Contracts that carry DFARS 252.204-7012 still require all 110 NIST SP 800-171 requirements, Level 2 self-assessments still score them, and the audit logging requirements are among the ones a later third-party assessment will test with live evidence rather than documents.

What Level 2 actually requires for logging

CMMC Level 2 uses NIST SP 800-171 Revision 2, not Revision 3. The Audit and Accountability (AU) family has nine requirements. The table shows what each one means for a SIEM and the points it carries in the DoD scoring method used for Level 2.

RequirementWhat it says (shortened)What it means in practicePoints
3.3.1Create and retain system audit logs to enable monitoring, analysis, investigation and reportingCollect logs from every in-scope system and keep them long enough to investigate5
3.3.2Trace the actions of individual users to those usersLogs must carry user identities; no shared accounts hiding who did what3
3.3.3Review and update logged eventsA documented list of what you log, reviewed on a schedule1
3.3.4Alert when audit logging failsAn alert when a system stops sending logs or logging is switched off1
3.3.5Correlate audit record review, analysis and reportingLook at events from different systems together to find suspicious activity5
3.3.6Provide audit record reduction and report generationSearch, filter and produce reports on demand1
3.3.7Synchronize clocks with an authoritative time sourceAll systems use the same time source, so timelines line up1
3.3.8Protect audit information and tools from unauthorized access, change and deletionRestricted, tamper-resistant log storage1
3.3.9Limit management of audit logging to a subset of privileged usersOnly a few administrators can change logging settings or the SIEM1

Three more requirements outside the AU family depend on the same logs:

  • 3.14.6 (5 points): monitor systems, including inbound and outbound traffic, to detect attacks and indicators of attack.
  • 3.14.7 (3 points): identify unauthorized use of organizational systems.
  • 3.6.1 and 3.6.2 (5 points each): run an incident-handling capability, and track, document and report incidents.

Points at stake in the Audit and Accountability family

Points each requirement is worth in the DoD scoring method for Level 2

Must be in place on assessment dayCan be closed within 180 days on a plan of action
3.3.1 Create and keep logs5
3.3.5 Correlate review across systems5
3.3.2 Trace actions to individual users3
3.3.3 Review and update what you log1
3.3.4 Alert when logging fails1
3.3.6 Search and report on demand1
3.3.7 Synchronize clocks1
3.3.8 Protect logs from change1
3.3.9 Limit who manages logging1
Only requirements worth 1 point can go on a plan of action and milestones. Related requirements 3.14.6, 3.6.1 and 3.6.2 are worth 5 points each, and 3.14.7 is worth 3. Source: 32 CFR 170.21 and 170.24.

Why 3.3.5 is the one that pushes you to a SIEM

NIST’s discussion of 3.3.5 says correlation can happen at the system level or across all systems in the organization. With two servers, a person reading logs side by side might pass. With a domain, a firewall, Microsoft 365, a VPN and fifty laptops, correlating by hand is not credible to an assessor, and it will not catch a password spray that touches your VPN and then your email in the same hour. That is exactly the job a SIEM does.

Which logging gaps you can fix after the assessment

A Level 2 assessment can end in a Conditional status with a plan of action and milestones (POA&M) if you score at least 80 percent, but only requirements worth 1 point can be on that plan (with one encryption exception). For logging, that means:

  • Must be in place on assessment day: 3.3.1, 3.3.2 and 3.3.5 from the AU family, plus 3.14.6, 3.14.7, 3.6.1 and 3.6.2.
  • Can be closed within 180 days on a POA&M: 3.3.3, 3.3.4, 3.3.6, 3.3.7, 3.3.8 and 3.3.9.

Put plainly, collecting logs, tying them to users, correlating them and monitoring for attacks cannot wait.

How long to keep logs

Neither CMMC nor NIST SP 800-171 sets a log retention period. 3.3.1 says to keep logs “to the extent needed” for monitoring and investigation. One related rule does set a number: DFARS 252.204-7012 requires you to preserve images of affected systems and all relevant monitoring and packet capture data for at least 90 days after you report a cyber incident. You can only preserve what you still have, so your normal retention must cover the time it takes to notice an incident, plus that 90 days.

Many contractors set one year as a floor, because attackers often stay hidden for months. Whatever you choose, write it in your system security plan and make sure the SIEM actually enforces it.

Your SIEM is in scope

CMMC defines Security Protection Assets as assets that provide security functions for the systems in your assessment scope. A SIEM fits that definition, so it is in scope. It has to appear in your asset inventory, system security plan and network diagram, and it is assessed against the Level 2 requirements that are relevant to what it does. Expect the assessor to check who can sign in to it, whether multi-factor authentication is on, how its logs are protected and how it is patched.

Cloud SIEMs, managed SOCs and FedRAMP

This is the most common question, and the final rule answers it. In CMMC terms, an External Service Provider (ESP) is one that processes, stores or transmits CUI or Security Protection Data, and Security Protection Data explicitly includes log files. So:

  • A cloud SIEM or managed SOC that handles only your logs (no CUI) is assessed as part of your Security Protection Assets. It does not need FedRAMP Moderate authorization, and it does not need its own CMMC certification, although a provider may get one voluntarily to make your assessment easier.
  • If your logs contain CUI, the provider is handling CUI, and a cloud provider must then meet the FedRAMP Moderate (or equivalent) requirements in DFARS 252.204-7012.
  • Either way, document the relationship in your system security plan, with the provider’s service description and a customer responsibility matrix that says which practices they cover and which stay with you.

Does your cloud SIEM need FedRAMP?

What the CMMC rule says about a provider that receives your logs

Can the logs you send to the provider contain CUI?
No, logs only
No FedRAMP neededThe service is assessed as one of your Security Protection Assets. It needs no CMMC certificate of its own.
Yes, or you cannot rule it out
FedRAMP Moderate or equivalentA cloud provider handling CUI must meet DFARS 252.204-7012. The alternative is to keep the SIEM inside your own CUI enclave.
Either way, list the provider in your system security plan with its customer responsibility matrix. Source: 32 CFR 170.4 and 170.19.

The catch is the word “contain”. File names, email subjects and database queries can all carry CUI into logs. If you cannot rule that out, the simplest answer is to keep the SIEM inside your own CUI environment.

What to look for in a SIEM for CMMC

Use this list when you compare products or managed services:

  1. Coverage of every in-scope asset: Windows and Linux systems, domain controllers, firewalls and VPNs, Microsoft 365 or GCC High, and cloud accounts. Gaps here fail 3.3.1.
  2. Real correlation across sources, not only search. Ask to see a detection that combines two systems (3.3.5).
  3. An alert when a log source goes quiet (3.3.4).
  4. User identity on every event and reports by user (3.3.2).
  5. Protected storage and least-privilege access to the SIEM itself, with multi-factor sign-in (3.3.8, 3.3.9).
  6. Retention you control, with old logs still searchable when you need them.
  7. Reports mapped to NIST SP 800-171, so evidence is ready before the assessor asks (3.3.6).
  8. A hosting choice that fits your CUI boundary: on your own servers inside the enclave, or a cloud service whose documentation you can put in your system security plan.

How UTMStack fits CMMC Level 2

UTMStack collects logs from Windows, Linux, firewalls, Microsoft 365 and the main cloud platforms, correlates every event against its detection rules as it arrives, and opens alerts and incidents you can track to closure, which covers the collection, correlation, monitoring and incident-tracking side of the requirements above. Its compliance module evaluates CMMC 2.0 controls from your own logs and keeps the evidence that decided each one; the CMMC 2.0 framework is included in the free Community edition. NIST SP 800-171 is one of the nine frameworks in the Enterprise edition.

Because UTMStack can run on your own servers, inside your CUI enclave if needed, logs that might contain CUI never have to leave it. The installer also supports networks with no internet access. If you would rather not run it yourself, UTMStack Cloud gives you a dedicated instance in the United States.

To see the CMMC report on sample data, open the live demo. For the wider program, read our guides to CMMC compliance requirements and NIST 800-171 compliance.

Frequently asked questions

Does CMMC Level 1 require a SIEM? No. Level 1 covers 15 basic safeguarding requirements for federal contract information and does not include the Audit and Accountability family.

Does CMMC Level 2 require a SIEM? Not by name. It requires the logging, correlation and monitoring practices in NIST SP 800-171, and a SIEM is the usual way to meet 3.3.5 (correlation) and 3.14.6 (monitoring) at any real scale.

What are the CMMC logging requirements? The nine Audit and Accountability requirements, 3.3.1 to 3.3.9: create and keep logs, trace actions to users, review what you log, alert on logging failures, correlate review across systems, generate reports, synchronize clocks, protect the logs and limit who manages logging.

What is the CMMC log retention requirement? There is no fixed period. Keep logs long enough to investigate incidents, and remember DFARS 252.204-7012 requires keeping relevant monitoring data for at least 90 days after you report an incident. One year is a common floor.

Does a cloud SIEM need FedRAMP for CMMC? Only if it processes, stores or transmits CUI. A cloud SIEM that receives only log data without CUI is assessed as a Security Protection Asset and does not need FedRAMP Moderate.

Is a SIEM in scope for a CMMC assessment? Yes. It provides security functions for your CUI environment, so it is a Security Protection Asset and is assessed against the requirements relevant to it.

Sources

Keep reading