8.15 Logging
Requires logs to be produced, stored, protected and analysed, covering activities, exceptions, faults and any other event of relevance. Older source material adds that records of user activity, exceptions and security ev
5
artefacts
3
held by a system
0
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Evidence of logging enabled, sampled across systems, with the retention period applied · SIEM / log platform
- Evidence logs are protected against alteration and deletion, including restriction of administrator ability to modify them · SIEM / log platform
- Evidence of analysis, showing logs are reviewed or fed to detection rather than merely stored · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The logging standard, defining what events are logged per system type, including access, privileged action, change and failure · Policy repository / GRC workspace
- Records of gaps in logging identified and remediated, including systems that cannot log to the standard · Policy repository / GRC workspace
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Logging enabled with retention shorter than the time it typically takes to discover an incident
- Logs held on the same system they record, so an attacker with control of the host controls the evidence
- Collection achieved and analysis absent, so the organisation pays for storage and receives no detection
- Cloud and software as a service audit logs never enabled because they carry an extra cost or licence tier
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.14 Redundancy of information processing facilities · 8.16 Monitoring activities