What this control covers
Log all access to personal data systems, including: user ID, timestamp, data accessed, action performed. Integrate logs into a SIEM for real-time monitoring and alerting. Set alerts for unauthorised access, unusual access patterns, and policy violations. Retain logs for minimum 1 year (Rule 6(1)(e)). Objective: Enable detection, investigation, and audit of all access to personal data, supporting breach detection and forensic investigation.
Why it matters
You cannot investigate or attest what you did not log. This control underpins every incident-response capability and is what auditors will sample from for control operating effectiveness.
How to implement
AWS
Turn on a multi-region, organisation-wide CloudTrail trail with log-file validation and ship to a dedicated, write-once log archive account. Enable CloudTrail Lake or stream to OpenSearch/Splunk for search. Pair with GuardDuty, Security Hub, and VPC Flow Logs.
Azure
Send Activity logs + diagnostic logs from every subscription to a central Log Analytics workspace. Stand up Microsoft Sentinel for SIEM/SOAR with the Azure, M365 and IdP connectors and pre-built analytics rules.
GCP
Centralize via Cloud Logging log sinks at the org level to a locked log bucket with 7-year retention. Use SCC Premium for posture findings and Chronicle for SIEM correlation.
Google Workspace
Forward the Admin, Login, Drive, Token and Mobile audit logs to Cloud Logging (Workspace BigQuery export). Alert on impossible-travel logins, OAuth-scope grants for high-risk scopes, and external Drive sharing of sensitive labels.
GitHub
Stream the Enterprise audit log to your SIEM and enable Audit Log API alerting on key events: owner changes, IP allowlist edits, secret deletions, repo visibility flips.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.policy_document— A signed, version-controlled policy stating leadership intent and the named owner.
Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Focus: Personal Data Access Logging & SIEM Monitoring.
Quick checklist
- Log — Personal Data Access Logging / Siem Monitoring
- Monitor — Personal Data Access Logging / Siem Monitoring
Related articles on this site
- Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No'
- NIST 800-171 3.1.1 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
- NIST 800-171 3.14.5 Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
- CMMC 2.0 AC.1.001 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)