OPS-14 Logging and Monitoring - Storage of the Logging Data
Consolidate log data from every source into a central store in an unchangeable and aggregated form for authorised evaluation, delete it once its purpose expires, authenticate between logging servers and logged assets, an
4
artefacts
3
held by a system
0
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Immutability or write once configuration of the log repository · SIEM / log platform
- Mutual authentication configuration between logging agents and collectors · Identity provider / directory
- Integrity verification output for an archived log batch · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Architecture diagram of log forwarding paths into the central collector · Policy repository / GRC workspace
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Logs held only on the originating host where an intruder can alter them
- Forwarding over unauthenticated plain syslog on the production network
- Central store writable by the same administrators whose actions it records
- Whole device classes such as network appliances never forwarded to the collector
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-13 Logging and Monitoring - Identification of Events · OPS-15 Logging and Monitoring - Accountability