What this control covers
Produce, store, protect and analyse logs of activities, exceptions and events related to PII. Implementation: Central log management, retention and analysis procedures; access controls for logs. Justification: Logs provide forensic evidence and detection capabilities.
Why it matters
You cannot investigate or attest what you did not log. This control underpins every incident-response capability and is what auditors will sample from for control operating effectiveness.
How to implement
AWS
Turn on a multi-region, organisation-wide CloudTrail trail with log-file validation and ship to a dedicated, write-once log archive account. Enable CloudTrail Lake or stream to OpenSearch/Splunk for search. Pair with GuardDuty, Security Hub, and VPC Flow Logs.
Azure
Send Activity logs + diagnostic logs from every subscription to a central Log Analytics workspace. Stand up Microsoft Sentinel for SIEM/SOAR with the Azure, M365 and IdP connectors and pre-built analytics rules.
GCP
Centralize via Cloud Logging log sinks at the org level to a locked log bucket with 7-year retention. Use SCC Premium for posture findings and Chronicle for SIEM correlation.
Google Workspace
Forward the Admin, Login, Drive, Token and Mobile audit logs to Cloud Logging (Workspace BigQuery export). Alert on impossible-travel logins, OAuth-scope grants for high-risk scopes, and external Drive sharing of sensitive labels.
GitHub
Stream the Enterprise audit log to your SIEM and enable Audit Log API alerting on key events: owner changes, IP allowlist edits, secret deletions, repo visibility flips.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.policy_document— A signed, version-controlled policy stating leadership intent and the named owner.
Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Focus: Logging.
Quick checklist
- Implement — Logging
- Log — Logging
- Provide — Logging
Related articles on this site
- NIST 800-171 3.2.1 Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to
- NIST 800-171 3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- NIST 800-171 3.3.8 Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
- CMMC 2.0 AT.2.056 Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to t