Key takeaways
- Record activities, errors and security events, and protect the logs.
- Logs tell you what happened.
- Start here: decide which events to log on which systems.
Purpose
Record activities, errors and security events, and protect the logs.
Requirement
Requirement summaryLogs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed.
Why it matters
Logs tell you what happened. Without them, investigation is guesswork.
How to implement
- Decide which events to log on which systems.
- Centralise logs and protect them from tampering.
- Set retention periods.
- Restrict access to logs.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.15. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your logging policy: which activities are recorded, how long logs are kept and how they are protected.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.15 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Settings showing logging is switched on for key systems, including administrator activity.
- Log retention settings.
- Proof that logs can't be changed or deleted by ordinary users.
Things you should be able to show or explain
- Be able to show a sample log with who did what and when.
How much to show: Three to five key systems.
Common mistakes
- Admin activity not logged.
- Logs kept for too short a time.
- Logging turned on but retained for only a few days.
- Admins able to delete their own activity logs.
- Tip: Centralise logs so attackers can't easily erase them.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.15 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.15?
Be ready to explain how the control works in your organisation and to provide things like: Your logging policy: which activities are recorded, how long logs are kept and how they are protected…