Audit Log
What is Audit Log?
A chronological record of system activities that provides documentary evidence of the sequence of activities affecting a specific operation, procedure, or event. Audit logs are essential for security monitoring, incident investigation, and compliance.
Terms that appear alongside audit log
Each of these is named in at least one of the same controls as audit log. The number is how many controls name both.
- audit 37 shared controls
- accountability 8 shared controls
- integrity 7 shared controls
- nist 7 shared controls
- compliance 5 shared controls
- log management 5 shared controls
- fedramp 4 shared controls
- log retention 4 shared controls
Frameworks that govern audit log
What the standards actually require on audit log
Requirements naming audit log across 6 standards, quoted from the control text.
Audit logs must record every access made to the audit logs themselves. Applies to all entities. The guidance explains that attackers often try to alter logs to hide what they did, so a trail of access lets the entity trace inconsistencies or tampering back to...
10.2.1.3 · 10.2.1.3 Access to the audit logs is itself logged →Where suitable and supported, gather audit logs of DNS queries from enterprise assets.
CIS-8.6 · Collect DNS Query Audit Logs →Keep audit logs from enterprise assets for at least 90 days. Implementation Groups: IG2 and IG3 (not in the IG1 baseline; applies from IG2 upward). Asset type: Data. Security function: Protect.
cis-controls-v8-1::8.10 · Retain Audit Logs →Allocate audit log storage capacity sufficient to collect audit logs for the retention period AU-11 requires.
fbi-cjis-security-policy::AU-4 · AU-4 Audit Log Storage Capacity →Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].
NIST800-AU-4 · AU-4 Audit Log Storage Capacity →Audit logs are protected so nobody can alter them. The assessor examines controls and configurations and observes attempts to modify logs.
pci-3ds-core-security-standard::P1-7.2.5 · P1-7.2.5 Audit logs protected from alteration →Questions people ask about audit log
What is Audit Log?
Why is Audit Log important for compliance?
Which compliance frameworks address Audit Log?
Where can I learn more about Audit Log?
See how Audit Log applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.