Crossfoot
Crossfoot / Controls / Logging, log review and monitoring
Draft v0.1.06 of 6 frameworks

Logging, log review and monitoring

Security-relevant events are logged, protected from tampering, retained, time-synchronized and reviewed.

Where it appears

SOC 2
CC7.2Monitors system components for anomalies indicative of malicious acts, natural disasters and errors
PCI DSS 4.0
10.2Audit logs are implemented to support detection of anomalies and suspicious activity
10.3Audit logs are protected from destruction and unauthorized modification
10.4Audit logs are reviewed to identify anomalies or suspicious activity
10.5Audit log history is retained and available for analysis
10.6Time-synchronization mechanisms support consistent time settings
NIST CSF 2.0
DE.CMContinuous monitoring
PR.PS-04Log records are generated and made available for continuous monitoring
ISO 27001:2022
A.8.15Logging
A.8.16Monitoring activities
A.8.17Clock synchronization
HIPAA Security Rule
164.312(b)Audit controls
164.308(a)(1)(ii)(D)Information system activity review
NIST 800-53 r5
AU-2Event logging
AU-6Audit record review, analysis and reporting
AU-11Audit record retention
SI-4System monitoring

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Logging standard defining events logged, retention period and review frequency
  • Configuration showing audit logging enabled on in-scope systems
  • SIEM or log platform alert rules and sample alert investigations
  • Evidence of log review (daily / periodic) with reviewer and date
  • Log retention evidence (PCI: 12 months, 3 months immediately available)

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0