Control A.8.15Logging
Logs that record activities, exceptions, faults and other relevant events must be produced, stored, protected and analysed.
Four verbs, and organisations reliably do the first two and stop. Producing logs is configuration; storing them is retention; protecting them is what makes them evidence — access restricted, alteration prevented, and for the highest value, written somewhere the administrators of the source system cannot change.
Analysed is the one that turns logging into a control rather than an archive, and A.8.16 is where that work actually happens.
What to log follows from what questions need answering later: authentication and its failures, privileged activity, access to sensitive information, changes to configuration and to the logging itself. Logging everything produces volume that hides the signal and a retention cost that eventually forces a reduction made on grounds of storage rather than of risk.
Logs are personal data in most jurisdictions, which makes retention and access a question for A.5.34 as well.
How to put this in place
Without logs you cannot investigate an incident, prove what happened or detect misuse. Your ISMS needs the right events recorded centrally, protected from tampering and kept long enough to be useful.
- Decide which events to log, such as sign-ins, administrator actions, security alerts and access to sensitive data.
- Include cloud services and network devices in scope, not only servers.
- Send logs to a central store that administrators cannot alter.
- Set retention and access rules, and record the time zone used.
- Test with a known event and confirm it appears in the logs.
Evidence an auditor usually looks for: the logging standard, central log configuration, retention settings, and log entries for a test event.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists logging rules and log retention among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.