SIEM for CMMC: What’s Actually Required, and What Passes an Assessment

Which path fits you — and which doesn’t

Before the detail, here’s where most companies actually land. Find your row.

The right CMMC provider isn’t the same for every contractor — the category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist. Because a general answer can’t resolve those for you, use The Defense Compliance Report’s Find My CMMC Path tool to map your situation to the right provider category before you request quotes — and do not submit CUI, drawings, or sensitive contract details.

Does CMMC require a SIEM?

No. CMMC Level 2 does not name a SIEM as a required product. It requires implementation and evidence for the 110 security requirements in NIST SP 800-171 Revision 2, inside a correctly scoped environment. A SIEM is a common, practical way to collect, correlate, protect, review, and report logs — but it is not a standalone compliance credential.

When someone says “you need a SIEM for CMMC,” they almost always mean something narrower and truer: your current logging probably can’t prove enough.That’s a real problem. It’s just not the same as “go buy this product.”

There is no government list of “CMMC-certified SIEMs.” There is no product you can purchase that converts your environment to compliant. CMMC status attaches to your assessed system — your scope, your controls, your documentation, your evidence — under 32 CFR Part 170. So when a page or a sales rep uses the phrase “CMMC-compliant SIEM,” treat it as marketing shorthand until they tell you exactly which control objectives the service supports, who is responsible for each one, how your data is handled, and what evidence it produces.

A more accurate way to think about it: you’re not buying a “compliant SIEM.” You’re building a SIEM capability used inside a CMMC Level 2 environment. The question that matters is whether the implemented system, the procedures around it, the scope, the evidence, and the provider responsibilities satisfy the requirements.

Here’s the one uncomfortable thing we’ll admit up front, because it will save some of you real money: buying a SIEM too early — before you’ve scoped your CUI — can make your CMMC project worse, not better. Point a powerful tool at everything “just in case” and you can light up cost spikes, drown your team in unreviewed alerts, push CUI-bearing logs into a provider that suddenly becomes part of your assessment, and end up with a dashboard but no evidence process. Companies can spend five figures on a SIEM and still fail the audit-logging controls if they never build the review habit the controls actually grade.

That’s the bad news. The good news is that it’s avoidable, and the fix is simple: scope first, then choose. Once you know what CUI you handle and where it lives, the right tooling decision — native logging, self-managed SIEM, or managed SIEM — usually becomes obvious. The rest of this page walks you through exactly that, with the primary sources so you can verify every claim yourself.

What does CMMC Level 2 actually require for logging?

CMMC Level 2 maps to NIST SP 800-171 Revision 2, which includes a nine-requirement Audit and Accountability (AU) family. Those requirements cover creating and retaining audit logs, tracing actions to users, reviewing logged events, alerting on logging failures, correlating records, generating reports, synchronizing time, protecting audit data, and limiting who can manage logging. Related monitoring and incident-response requirements live in the SI and IR families.

This is the heart of it. The logging obligations come from four places in NIST SP 800-171 Rev. 2, and you can read the control text yourself in the official publication:

• Audit and Accountability (AU), §3.3.1–3.3.9 — the core nine.
• System and Information Integrity (SI), §3.14.6–3.14.7 — system and traffic monitoring; identifying unauthorized use.
• Incident Response (IR), §3.6.1–3.6.3 — an operational incident-handling capability, incident tracking and reporting, and testing that capability.
• Security Assessment (CA), §3.12.3 — monitoring your controls on an ongoing basis.

CMMC writes each of these as a practice with an identifier — for example, AU.L2-3.3.1 is the Level 2 practice that maps to NIST §3.3.1. Here is the part nobody else assembles in one place: what each requirement actually asks for, where a SIEM genuinely helps, and — just as important — what a SIEM does not solve. We built this table from the NIST Rev. 2 control text and the assessment objectives in NIST SP 800-171A.

The CMMC logging requirements, and where a SIEM fits

Two things to internalize from that table. First, a SIEM is genuinely useful — six or seven of these requirements are far easier to evidencewith one. Second, a SIEM is not a “buy and you’re done” purchase. Every one of these has a process-and-documentation half that the tool can’t do for you. As we put it to readers: “we have logs” is not the same as “we have evidence.” An assessor will want to see who reviews logs, what they review, what triggers escalation, where that review is recorded, and how it ties back to your scope.

How long do you have to keep logs for CMMC?

NIST SP 800-171 Rev. 2 does not set a fixed log-retention number — you define a retention period in your System Security Plan (SSP) that supports monitoring, analysis, and investigations. Separately, DFARS 252.204-7012 requires that if you report a cyber incident, you preserve images of affected systems and relevant monitoring data for at least 90 days after reporting. Many organizations adopt 90 days “hot” plus one to three years archived as a practical standard.

This is one of the most common myths we have to correct. You’ll see pages assert “NIST requires one year of logs” or “90 days.” Read the control text — there is no such number in NIST SP 800-171 Rev. 2 §3.3.1. What does exist are three separate things people blur together:

1. Your org-defined retention.You set it, in your SSP, sized to support investigation. That’s the rule.
2. The DFARS 90-day preservation floor. DFARS 252.204-7012 requires preserving incident-relevant monitoring and packet-capture data for at least 90 days after you report a cyber incident.That’s an incident-response obligation, not a general logging-retention rule.
3. Common practice.Many DIB shops keep about 90 days immediately searchable plus a longer archive (often a year or more) because investigations and assessors benefit from it. That’s a sensible convention — not a regulation. Treat it as such.

Getting this distinction right is itself a small proof that you understand the rules better than the vendor who quoted you “one year, because NIST.”

When is native Microsoft 365 logging enough for CMMC?

Native Microsoft logging can be enough for a narrow, well-scoped Microsoft 365 CUI environment — if audit logging, retention, export, review, alerting, log protection, and role separation are configured and documented. It is not enough merely to own Microsoft 365. Microsoft states that audit behavior and retention depend on your license and policy configuration, and some logs default to only 180 days.

A lot of small contractors don’t need a separate SIEM product on day one. They need to actually configure and evidence what they already pay for. Before you buy anything, pressure-test whether native logging fits — and verify each line, because the defaults will surprise you.

The retention trap. Per Microsoft’s documentation, Microsoft Purview Audit (Standard) retains logs for 180 days by default for logs generated on or after October 17, 2023 (it was 90 days before that date — if your tenant is older, some records may have been kept only 90 days). Audit (Premium) retains Exchange, SharePoint, OneDrive, and Microsoft Entra ID records for one year by default and up to 10 yearswith an add-on — but Premium requires E5 or the equivalent Purview add-on, and even then non-core workloads default to 180 days unless you create custom retention policies. If you’re on a lower license, the standard workaround is to stream audit events to a SIEM via the Office 365 Management Activity API, where your retention policy governs the data.

Here’s the same picture as a quick reference you can take into a licensing conversation:

The Sentinel cost reality.Microsoft Sentinel is a cloud-native SIEM and SOAR (Security Orchestration, Automation, and Response) platform, and it’s a common choice precisely because it’s built around frameworks like NIST. But its pricing is driven by data volume: the analytics tier is billed per GB, either pay-as-you-go or via commitment tiers (starting at 100 GB/day), with the first 90 days of interactive retention included and longer retention billed separately. Helpfully, several sources — Office 365 audit logs, Azure activity logs, and Microsoft Defender alerts — are ingested at no cost. The practical takeaway: estimate your GB/day beforeyou commit, and don’t ingest everything reflexively, or a logging line item turns into a budget problem.

A note for the small shop. We hear this one constantly: “We’re a small team — how do we separate duties for log review when one person does everything?” It’s a fair worry, and it’s an operational answer, not a tooling one. Document who reviews logs and how often, define escalation, and use compensating procedures. If your staffing is genuinely too thin to run this credibly, that’s a strong signal to bring in an RPO for the design or move to a managed service for the operation — which is exactly the next question.

Self-managed SIEM vs managed SIEM for CMMC vs no SIEM: which path fits?

The right path depends on your required level, FCI vs CUI handling, assessment type, log-source complexity, internal staffing, cloud environment, and timeline. Native logging may suffice for a narrow environment; a self-managed SIEM fits teams with security-operations capacity; a managed SIEM or MSSP (Managed Security Service Provider) fits contractors who need monitoring, triage, and evidence support without standing up a Security Operations Center (SOC).

Use this to find your row. It’s the same logic our decision tool runs, just on one page.

A quick word on the levels, because the rule treats them differently. Level 1 (FCI only) is based on the 15 security requirements in FAR 52.204-21, assessed by annual self-assessment and affirmation, with no audit-logging family — a SIEM is rarely the right first move. Level 2(CUI) is all 110 NIST SP 800-171 Rev. 2 requirements, and is where logging and a SIEM-class capability matter most; it’s either a self-assessment or a C3PAO certification assessment, set by your contract clause. Level 3 adds 24 selected requirements from NIST SP 800-172, requires Final Level 2 (C3PAO) status as a prerequisite, and is assessed by the Defense Contract Management Agency’s DIBCAC (Defense Industrial Base Cybersecurity Assessment Center). One Level 3 requirement calls for a security operations center capability that operates around the clock (it allows on-call or remote staffing) — a SIEM is common architecture for that, not a named product requirement.

Notice what the table is really telling you: the deciding factors aren’t “which SIEM is best.” They’re your environment and your staffing. The hard part of these controls is never collecting logs — it’s reviewing, triaging, escalating, and producing evidence on a schedule. That’s the labor a managed service exists to absorb.

How does a SIEM fit into CMMC scope — SPA, SPD, ESP, and FedRAMP?

A SIEM can change your CMMC scope. Under 32 CFR Part 170, a SIEM used to protect your environment is a Security Protection Asset (SPA), and the logs it generates or ingests are Security Protection Data (SPD). A managed SIEM provider is an External Service Provider (ESP) when it processes, stores, or transmits your CUI or Security Protection Data on its assets. Where a provider stores, processes, or transmits CUI as a Cloud Service Provider (CSP), FedRAMP requirements under DFARS 252.204-7012 apply.

This is the section the product pages skip, and it’s the one that catches people. Let’s be precise, because precision is the whole point.

Your SIEM is a Security Protection Asset. The DoD’s own CMMC Level 2 Scoping Guide uses a SIEM as its worked example: an External Service Provider that provides a SIEM service may be logically separated and may not even process CUI, yet the SIEM still contributes to meeting CMMC requirements and is therefore inside your assessment scope as a Security Protection Asset. In plain terms: the tool that watches your environment is part of what gets assessed.

Your logs can be Security Protection Data.The rule’s definition of an ESP at 32 CFR §170.4 explicitly names “log data” as an example of Security Protection Data. So even if your SIEM never touches CUI directly, the security log data it holds can be SPD — which is enough to bring it and its provider into scope.

Your managed SIEM provider’s treatment depends on what it touches. 32 CFR §170.19 lays out the scoping logic. We translated it into the four scenarios that actually apply to a SIEM:

Does your managed SIEM provider need its own CMMC certification? No — 32 CFR Part 170 does not require every ESP to hold its own CMMC certification (earlier drafts of the rule would have; the final rule dropped that). Here’s how it actually works: if the ESP processes, stores, or transmits your CUI or Security Protection Data, those services are pulled into your assessment scope under §170.19. The ESP mayvoluntarily undergo its own CMMC assessment to reduce the assessment effort when you’re assessed — but the minimum assessment type is dictated by your DoD contract, not the provider’s preference. Either way, the relationship has to be documented in your SSP and in the provider’s Customer Responsibility Matrix.

Now, the FedRAMP question — stated precisely. DFARS 252.204-7012 requires that if you use an external cloud service to store, process, or transmit covered defense information (which overlaps heavily with CUI), that cloud service must meet security requirements equivalent to the FedRAMP Moderate baseline and comply with the clause’s incident-reporting and preservation obligations. A December 2023 DoD CIO memo defines “FedRAMP Moderate equivalent” strictly: 100% of the FedRAMP Moderate controls, assessed by a FedRAMP-recognized third-party assessor, with a defined body of evidence — and it puts the burden on you to obtain and review that evidence. A cloud service with a valid authorization on the FedRAMP Marketplace satisfies this automatically.

Here’s where contractors get it wrong in both directions. Don’t assume a cloud SIEM is disqualified just because it’s “commercial” — Microsoft, for example, states that both Azure Commercial Cloud and Azure Government hold FedRAMP High authorizations. And don’t assume it’s fine because the brand is familiar — Microsoft 365 in its commercial form does not attest to meeting DFARS 252.204-7012, while GCC High (whose data resides in Azure Government) is the version Microsoft positions for covered defense information, including export-controlled data. The point isn’t the brand. It’s that you have to verify the exact offering: its FedRAMP Marketplace package and authorization boundary, where your data resides, who can access it (U.S.-person access can matter for ITAR-controlled data), connector support in that cloud, and — the question that decides everything — whether CUI actually flows into the SIEM at all.

The honest nuance, and where careful contractors get it right: this CUI-in-the-cloud rule is not the same as “every log-handling vendor must be FedRAMP.” A provider that handles only Security Protection Data and never touches CUI is assessed as a Security Protection Asset, not automatically held to the CSP FedRAMP standard. Map your data flow first; don’t apply the FedRAMP conclusion reflexively. This is exactly the kind of distinction that’s worth getting an RPO’s eyes on before you sign a SIEM contract.

What will a C3PAO or assessor actually want to see?

An assessor does not certify a SIEM label. Per the NIST SP 800-171A methodology, they examine, interview, and test to determine whether your scoped system satisfies the requirements. For logging, the evidence has to connect your SSP, asset inventory, log sources, procedures, review records, alert handling, reports, time synchronization, access restrictions, and any provider responsibilities.

This is the reframe that changes how you buy. You’re not assembling a tool stack to impress anyone. You’re assembling an evidence package. Here’s what that package looks like for the logging controls.

A blunt point worth making to every buyer: a dashboard screenshot proves almost nothing by itself. It has to be tied to a requirement, a scoped asset, a written procedure, a review record, and a responsible role. A beautiful SIEM with no review records is a finding waiting to happen.

One independence rule worth flagging here, because it shapes who you can hire for what: a C3PAO cannot assess an organization it has provided consulting or implementation services to. That firewall lives in the rule’s Code of Professional Conduct requirements at 32 CFR §170.8(b)(17), which bar CMMC Ecosystem members from participating in a Level 2 certification assessment for an organization they served as a consultant to prepare for any CMMC assessment within the previous three years. Practically: the firm that helps you implement your SIEM and build your evidence cannot also be the C3PAO that certifies you. Plan for that separation early — readiness help from one category, the formal assessment from another. (See our C3PAO vs RPO breakdown for more.)

How much does a SIEM for CMMC cost?

SIEM cost depends on log volume, retention, connectors, analyst coverage, tuning, and evidence expectations. As of June 2026, a SIEM license alone (for example, Microsoft Sentinel) commonly runs roughly $15,000–$100,000+ per year, driven by data volume. A CMMC-aligned managed SIEM or SOC service typically runs about $1,000–$5,000 per month at the light end and roughly $8,000–$18,000 per month for 24/7 mid-tier coverage. These are market estimates, not regulated prices — your number depends on your environment.

We won’t pretend there’s a single sticker price; anyone who quotes you one without seeing your environment is guessing. What we can give you is the honest market picture and the levers that move it.

How we sourced these: The Defense Compliance Report reviewed published SIEM and managed-SOC pricing pages and market sources in June 2026. The figures below are directional ranges, not regulated prices; they exclude implementation and remediation unless noted, and you should confirm them with scoped quotes for your environment.

The cost-drivers worth asking about before any quote: your GB/day of ingestion, your retention period, the number of log sources/connectors, whether “24/7” means human triage or just automated alerting, how many tuning cycles are included, whether evidence reports mapped to NIST 800-171 are part of the deal, and what happens after escalation (monitoring is not always incident response).

A reframe that helps leadership: evaluate this against contract value at risk, not as a line item in a vacuum. A subcontract that requires CMMC Level 2 to keep is worth protecting with a properly scoped program. And a quote that comes in far below market usually means below-market scope — get the full scope in writing.

What should you verify before buying a “CMMC-compliant SIEM”?

Don’t buy on the phrase “CMMC-compliant SIEM.” Verify the specifics: which control objectives the service supports, log-source coverage, retention, audit-failure alerting, correlation and reporting, protected log storage, restricted administration, incident handoff, evidence exports, SSP/CRM language, data handling, and whether the provider touches CUI or Security Protection Data. No SIEM vendor can guarantee your CMMC status.

Here is the checklist we’d hand a contractor walking into a vendor call. Each question ties back to a control or a scoping rule.

And a short list of phrases that should make you slow down — not because the vendor is dishonest, but because each one papers over something you need to pin down:

• “CMMC-certified SIEM” (there’s no such certification)
• “Guaranteed CMMC compliance” (no vendor can guarantee your assessment outcome)
• “We’ll get you through your C3PAO assessment” (a C3PAO assesses you; a vendor can’t pass it for you)
• “You won’t need an SSP” (you will)
• “FedRAMP isn’t relevant here” (verify that against your data flow)
• “Just turn on Sentinel and you’re covered” (configuration, review, and evidence are the work)

The fastest way to make this concrete for your environment is to run it through Find My CMMC Path: answer a few non-sensitive questions — required level, FCI vs CUI, your cloud environment (M365 commercial, GCC, GCC High, AWS, AWS GovCloud, on-prem, or mixed), rough scope, in-house security capacity, monitoring need, and timeline — and it maps you to the category that fits: native logging may be enough, a self-managed SIEM, a managed SIEM/MSSP, scope-with-an-RPO-first, a CUI enclave, or a Level 3 / DIBCAC path. It’s a category map, not a compliance score — and it won’t tell you you’re “compliant,” because no tool can.

If you’re behind, do this first

If a contract clause or a prime just put CMMC in front of you and you feel behind, do not buy a tool first. Confirm your clause and level, identify your FCI/CUI, define your assessment scope, inventory your log sources and Security Protection Assets, map your gaps against the AU family, then choose native logging, self-managed SIEM, or managed SIEM — and build a recurring evidence habit before assessment.

The order matters, because a tool bought out of order becomes a liability. Seven steps, in sequence:

1. Confirm the contract clause and your required CMMC level.
2. Determine whether you handle FCI only or CUI.
3. Define your CMMC Assessment Scope per 32 CFR §170.19.
4. Inventory CUI assets, Security Protection Assets, Security Protection Data, ESPs, and CSPs.
5. Map your current logging against AU.L2-3.3.1 through 3.3.9.
6. Choose native logging, self-managed SIEM, or managed SIEM based on the result.
7. Build the review, alert, report, and evidence cadence — and document it.

If you have roughly a quarter before you need to show readiness, here’s a realistic runway that produces evidence, not just a tool:

There’s real urgency here, and it’s not manufactured. CMMC Phase 1 has been in effect since November 10, 2025, and Phase 2 begins November 10, 2026 — the point at which DoD intends to require a Level 2 (C3PAO) certification for applicable contracts as a condition of award, per 32 CFR Part 170 and DFARS 252.204-7021. A last-minute SIEM purchase can’t manufacture months of review history. The authorized C3PAO pool is finite, demand is rising into that deadline, and the time between a solicitation dropping and an award is rarely long enough to start your CMMC journey from scratch. Starting your evidence trail early is the cheapest insurance you can buy.

SIEM for CMMC: frequently asked questions

These are the follow-ups that send contractors back to the search bar — whether a SIEM is required, whether Microsoft tools are enough, whether logs are CUI, whether your provider is in scope, and whether a SIEM can guarantee certification. Short, direct answers below, each pointing back to the sourced detail above.

Is there such a thing as a CMMC-compliant SIEM?

A SIEM tool can support CMMC evidence, but CMMC status applies to your assessed environment and controls, not to a product label. Treat “CMMC-compliant SIEM” as marketing shorthand unless the vendor specifies the control objectives supported, responsibilities, data handling, and evidence outputs.

Does CMMC Level 2 require a SIEM?

No. CMMC Level 2 requires the 110 NIST SP 800-171 Rev. 2 requirements. The audit and monitoring requirements can be met with native logging, a self-managed SIEM, or a managed SIEM, depending on your scope and evidence needs.

Can Microsoft Sentinel be used for CMMC?

Yes, Sentinel can serve as the SIEM layer in a CMMC environment, but configuration, log sources, retention, data handling, and evidence still matter — and where it touches CUI, deployment in an authorized boundary (such as Azure Government) is what addresses the FedRAMP requirement. Its pricing is driven by data volume and retention.

Can Microsoft 365 audit logs be enough?

Possibly, for a narrow Microsoft-based scope with the right licensing, audit settings, retention, review process, and evidence exports. Microsoft notes that audit retention varies by license — Audit (Standard) defaults to 180 days.

Do SIEM logs count as CUI?

Not automatically. But logs generated by or ingested by a Security Protection Asset can be Security Protection Data under 32 CFR §170.4, which can affect scope and provider responsibility even when no CUI is involved.

Is a managed SIEM provider an External Service Provider?

It is when it processes, stores, or transmits your CUI or Security Protection Data — such as log or configuration data — on its assets. When that’s the case, document its role in your SSP and a Customer Responsibility Matrix per 32 CFR §170.19.

Does a SIEM provider need FedRAMP authorization?

If the provider is a cloud service that stores, processes, or transmits CUI, DFARS 252.204-7012requires FedRAMP Moderate or equivalency. If it handles only Security Protection Data and no CUI, scoping still applies, but don’t apply the same FedRAMP conclusion without checking the data flow.

Can a SIEM guarantee CMMC certification?

No. A SIEM supports evidence and monitoring, but certification depends on your full scoped implementation, documentation, practices, and evidence.

What if a C3PAO says we need a SIEM?

Ask which requirement or assessment objective they believe your current process can’t satisfy. The gap is usually correlation, retention, alerting, reporting, log protection, separation of duties, or review cadence — not the absence of a specific product.

Should Level 1 contractors buy a SIEM?

Usually not as a first move. Level 1 is FCI-only and based on the 15 security requirements in FAR 52.204-21, with no audit-logging family. Confirm your contract and actual level before buying Level 2-style tooling.

Can our MSP manage our SIEM and also be our C3PAO?

No, not for the same engagement. The rule’s Code of Professional Conduct (32 CFR §170.8(b)(17)) bars CMMC Ecosystem members from participating in a Level 2 certification assessment for an organization they served as a consultant to prepare for any CMMC assessment within the previous three years. Keep readiness help and the formal assessment in separate hands.

How long must we retain logs for CMMC?

NIST SP 800-171 Rev. 2 sets no fixed number — you define retention in your SSP. Separately, DFARS 252.204-7012 requires preserving incident-related monitoring data for at least 90 days after reporting a cyber incident. Many organizations keep about 90 days hot plus a longer archive as common practice.

The bottom line

A SIEM can make CMMC dramatically easier to operate and evidence. But CMMC does not certify a SIEM. It assesses your scoped environment, your implemented requirements, your documented responsibilities, and your evidence. So the right question was never “which SIEM is CMMC compliant?” It’s “what logging evidence do we need for our CUI scope, and who is responsible for reviewing, protecting, retaining, and producing it?” Answer that, and the tooling decision gets easy — and a lot cheaper.

The right CMMC provider isn’t the same for every contractor — the category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.