6.9.4 Logging and monitoring
Event logs must be reviewed by continuous automated monitoring or by manual review at a documented frequency to find irregularities and propose remediation, logs must where possible record access to personal data includi
5
artefacts
4
held by a system
1
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Log schema evidencing capture of who, when, whose data and what change · SIEM / log platform
- Access controls over log stores and evidence logs are deleted or de-identified per the retention schedule · SIEM / log platform
- Documented allocation of logging roles where multiple providers are involved, with any log access agreement · Identity provider / directory
- Where customers can read logs, evidence of tenant isolation and immutability · SIEM / log platform
periodic reviewEvidence produced at each review
- Documented log review process with the frequency stated, or evidence of automated monitoring and alerting · SIEM / log platform
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Logs generated and never reviewed, so the control produces evidence for an investigation that nobody starts
- Access logging at system level only, so it is impossible to say whose personal data was read
- Log stores excluded from the retention schedule, quietly becoming the longest lived copy of the personal data
- Customer log access implemented without isolation, exposing one customer's activity to another
- Shared responsibility for logging left undefined between providers, so neither retains what is needed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet