IAM-12 Safeguard Logs Integrity
Make the logging infrastructure append-only for everyone including privileged users, and control the ability to disable logging through a procedure with separation of duties and a break glass path.
4
artefacts
2
held by a system
1
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration showing write-only or append-only access to logs · SIEM / log platform
- Evidence that privileged platform roles cannot alter or delete logs · Identity provider / directory
periodic reviewEvidence produced at each review
- Break glass records and their review · SIEM / log platform
governing documentDocuments that govern the control
- The procedure governing disabling of logging, with separation of duties · Policy repository / GRC workspace
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Platform administrators able to delete log data
- Logging disable capability available with no procedure around it
- Break glass used without subsequent review
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIAM-11 CSCs Approval for Agreed Privileged Access Roles · IAM-13 Uniquely Identifiable Users