> ## Content Index > Fetch the complete content index at: https://www.cmmcoperator.com/llms.txt > Use this file to discover other available public pages before exploring further. # Continuous Monitoring for a macOS Fleet Under CMMC - URL: https://www.cmmcoperator.com/continuous-monitoring-for-a-macos-fleet-under-cmmc/ - Published: 2026-08-09T14:00:00.000Z - Updated: 2026-08-09T14:00:00.000Z - Description: CA.L2-3.12.3 requires monitoring controls on an ongoing basis. What that means for macOS unified logging, what 800-171 says about retention, and what a C3PAO accepts as evidence. - Author: HydratedSec - Tags: macOS + CMMC **Quick answer: continuous monitoring is a requirement in its own right, and a Windows-only toolchain cannot satisfy it for Macs.** CA.L2-3.12.3 requires monitoring security controls on an ongoing basis, including assessing control effectiveness. If your Macs sit outside the pipeline that produces that evidence, the requirement is not met for those assets. ## What does CA.L2-3.12.3 actually require? The CMMC Assessment Guide Level 2 titles it Continuous Monitoring, and the obligation is ongoing rather than annual. That single word is what separates it from CA.L2-3.12.1, the point-in-time control assessment. It does not sit alone. Several requirements carry recurring duties that compound per platform: - **RA.L2-3.11.2 Vulnerability Scan**, which runs periodically and again when new vulnerabilities are identified. - **RA.L2-3.11.3 Vulnerability Remediation.** - **SI.L1-3.14.1 Flaw Remediation** and **SI.L1-3.14.2 Malicious Code Protection**. - **SI.L1-3.14.5 System and File Scanning**, which requires periodic scans and real-time scanning of external files. - **SI.L2-3.14.3 Security Alerts and Advisories**, **SI.L2-3.14.6 Monitor Communications for Attacks**, and **SI.L2-3.14.7 Identify Unauthorized Use**. None of these is a one-time activity. Each one is a workload that repeats for as long as the asset exists. ## Which macOS log events satisfy the AU family? Start from what the requirements say rather than from what a tool produces. NIST SP 800-171 Rev 2 is direct here. 3.3.1 requires you to "create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity." 3.3.2 requires that "the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions." 3.3.3 requires you to "review and update logged events." 3.3.5 requires you to "correlate audit record review, analysis, and reporting processes for investigation and response." 3.3.6 requires "audit record reduction and report generation to support on-demand analysis and reporting." Read 3.3.1 and 3.3.2 together and the macOS work becomes concrete. You need authentication events, privilege escalation, policy and configuration changes, and security tooling state, each attributable to a named user. On macOS those live across the unified logging system, the Endpoint Security framework used by security agents, and your MDM's own compliance reporting. Three sources, not one. The organisation decides which events count. That is the point of 3.3.3, and it is an organisation-defined decision that has to be written down rather than inferred from a default configuration. ## How do you get unified logs into a SIEM? macOS unified logging is not a flat text file. It is a structured binary store queried with the log command, and it is designed for local diagnostics rather than long-term retention. The practical consequence is that shipping matters more than enabling. A log that exists on the endpoint and nowhere else will not survive the investigation window 3.3.1 contemplates. Three patterns are in common use: - A log collection agent that streams filtered predicates off the endpoint. - A security agent built on the Endpoint Security framework, emitting its own telemetry. - MDM compliance reporting, which covers configuration state. Most fleets need at least two. MDM reporting answers configuration questions and says nothing useful about user activity. Whichever you choose, document the filter. An assessor asking about 3.3.1 is asking which events you decided were needed and why, not which product you bought. ## How long must Mac audit logs be retained? NIST SP 800-171 Rev 2 does not name a retention period. 3.3.1 sets the standard as "to the extent needed" for monitoring, analysis, investigation, and reporting. Retention is therefore an organisation-defined value, and defining it is your job. Be careful with the macOS default. Local unified log storage is bounded by size rather than by time, so the retention window on a busy machine is shorter than on a quiet one and neither is a number you chose. Measure what your fleet actually keeps, pick a period you can defend, and enforce it at the collection tier rather than on the endpoint. ## What evidence does a C3PAO accept? 32 CFR 170.24 defines a requirement as MET when "all applicable objectives for the security requirement are satisfied based on evidence," and adds that "all evidence must be in final form and not draft." For continuous monitoring that usually means four things together: - The written procedure defining what is monitored and how often. - Dated output showing the activity happened on the stated cadence. - The record of what was found. - Evidence of what was done about it. A dashboard screenshot proves the tool exists. It does not prove the cadence held. This is where a second fleet gets expensive, and it is the honest version of the argument. The requirement count does not change. The evidence pipeline doubles. We work through that in [boundary protection on a Mac fleet](https://www.cmmcoperator.com/boundary-protection-on-a-mac-fleet-applying-control-vs-protect-to-macos-for-cmmc-l2/), and the asset side in [Mac asset classification for CMMC](https://www.cmmcoperator.com/mac-asset-classification-cmmc/). ## Sources - NIST SP 800-171 Rev 2, requirements 3.3.1, 3.3.2, 3.3.3, 3.3.5, 3.3.6 - CMMC Assessment Guide Level 2, v2.13, requirement titles for CA.L2-3.12.3, RA.L2-3.11.2, SI.L1-3.14.5 - 32 CFR 170.24 *Verified against primary sources on August 1, 2026\. Retention and tooling behaviour should be measured in your own environment. This is not legal advice.*