AU.L2-3.3.2: User Accountability — Trace Actions to Individual Users

What this means

User accountability requires that your organization implements mechanisms to link system actions directly to individual users. This means establishing unique identifiers for each user, logging their activities comprehensively, and maintaining records that cannot be repudiated. When a user performs an action—whether accessing data, modifying a record, or executing a command—your systems must capture who did it, what they did, when they did it, and from where. This eliminates shared accounts, requires proper authentication, and prevents users from denying their actions later.

How to comply

1. 1.Assign unique user identifiers (usernames, employee IDs) to every individual who accesses your systems—eliminate shared or generic accounts
2. 2.Implement comprehensive audit logging that captures user actions, including logins, data access, modifications, deletions, and administrative commands
3. 3.Configure systems to record timestamps and session details for all logged activities to establish the when and where of each action
4. 4.Enable multi-factor authentication and strong password policies to ensure user identities are verified before system access
5. 5.Restrict user permissions using the principle of least privilege so actions are limited to job-required functions
6. 6.Protect audit logs from unauthorized modification or deletion through write-once storage, encryption, and access controls
7. 7.Regularly review audit logs and user activity reports to identify anomalies, unauthorized access, or policy violations
8. 8.Establish a user access review process to validate that active accounts remain necessary and aligned with current roles

Evidence auditors look for

• Audit logs showing user login events with timestamps, source IP addresses, and authentication methods
• System activity logs documenting user actions (file access, data modifications, administrative commands) with unique user identifiers
• User account inventory with unique identifiers assigned to each individual and proof that shared accounts have been eliminated
• Access control policies defining user roles, permissions, and the principle of least privilege
• Multi-factor authentication configuration screenshots and enrollment records
• Log retention policy documentation showing how long audit records are maintained and protected
• Evidence of periodic user access reviews with sign-off from management confirming account necessity
• Screenshots of audit log protections demonstrating write-once storage or equivalent controls

Frequently asked questions

GRCWatch automatically collects and correlates audit logs from your systems and cloud environments, creating a unified accountability dashboard that shows exactly who did what and when—eliminating manual log review and accelerating your audit evidence gathering.

See how GRCWatch handles this control automatically

Related controls