Control A.8.15Logging
What it means in practice
Logs that record activities, exceptions, faults and other relevant events must be produced, stored, protected and analysed.
Four verbs, and organisations reliably do the first two and stop. Producing logs is configuration; storing them is retention; protecting them is what makes them evidence — access restricted, alteration prevented, and for the highest value, written somewhere the administrators of the source system cannot change.
Analysed is the one that turns logging into a control rather than an archive, and A.8.16 is where that work actually happens.
What to log follows from what questions need answering later: authentication and its failures, privileged activity, access to sensitive information, changes to configuration and to the logging itself. Logging everything produces volume that hides the signal and a retention cost that eventually forces a reduction made on grounds of storage rather than of risk.
Logs are personal data in most jurisdictions, which makes retention and access a question for A.5.34 as well.
How to put this in place
Without logs you cannot investigate an incident, prove what happened or detect misuse. Your ISMS needs the right events recorded centrally, protected from tampering and kept long enough to be useful.
- Decide which events to log, such as sign-ins, administrator actions, security alerts and access to sensitive data.
- Include cloud services and network devices in scope, not only servers.
- Send logs to a central store that administrators cannot alter.
- Set retention and access rules, and record the time zone used.
- Test with a known event and confirm it appears in the logs.
Evidence an auditor usually looks for: the logging standard, central log configuration, retention settings, and log entries for a test event.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists logging rules and log retention among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Word
Business Email Compromise Response Playbook
in Security Incident ManagementIts Framework References list this control. Supported by: B4 and Evidence preservation: audit and sign-in logs exported. - Word
Privileged Access Standard
in Privileged Access ManagementIts Framework References list this control. Supported by: Logging of privileged activity (PA-08). - Word
Privileged Session Review Record
in Privileged Access ManagementIts Framework References list this control. Supported by: Sources: privileged events logged where administrators cannot change them. - Excel
Immutable & Offline Backup Protection Checklist
in Backup & Restore AssuranceIts Framework References list this control. Supported by: BP-12 and BP-13: alerts on changes to backups, and the daily review of job results.