CIS · Control 8.3 · Priority: critical · Component: Protect

What this control covers

Ensure that logging destinations maintain adequate storage to comply with the enterprise's audit log management process.

Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

How to implement

AWS

Codify the policy intent as SCPs, AWS Config conformance packs, and Security Hub standards so the cloud enforces what the document says.

Azure

Codify in Azure Policy initiatives (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

GCP

Centralize via Cloud Logging log sinks at the org level to a locked log bucket with 7-year retention. Use SCC Premium for posture findings and Chronicle for SIEM correlation.

Google Workspace

Forward the Admin, Login, Drive, Token and Mobile audit logs to Cloud Logging (Workspace BigQuery export). Alert on impossible-travel logins, OAuth-scope grants for high-risk scopes, and external Drive sharing of sensitive labels.

GitHub

Stream the Enterprise audit log to your SIEM and enable Audit Log API alerting on key events: owner changes, IP allowlist edits, secret deletions, repo visibility flips.

On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.
  • policy_document — A signed, version-controlled policy stating leadership intent and the named owner.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Signed policy or standard documents the safeguard. Focus: Ensure Adequate Audit Log Storage.

Quick checklist

  • Ensure — Network / Audit Log Management Process
  • Log — Network / Audit Log Management Process
  • Protect — Network / Audit Log Management Process

Related articles on this site