A.8.15

Objective

Produce, store, protect, and analyse logs that record activities, exceptions, faults, and other relevant events.

Points of focus

• Authentication, authorization, and admin-plane events are captured for every production system
• Logs are shipped to a centralized, append-only store separate from the source system
• Access to view and, especially, to modify or delete logs is restricted and itself logged
• Retention period is defined per log category and matches incident-response and compliance needs
• Clock synchronization (NTP) keeps timestamps consistent across systems for correlation

Implementation notes

Route logs from every layer that matters for security investigations — identity provider sign-ins, cloud API calls (CloudTrail/Activity Log), Kubernetes audit logs, database audit logs, application-level admin actions, and WAF/network events — into one centralized platform rather than leaving them scattered across each service's native retention. Separate the identity that writes logs from the identity that can delete or modify them; use write-once storage or a dedicated log-shipping service account with no delete permission, and require a documented break-glass process for the rare legitimate deletion (e.g. a legal hold expiring). Define retention per category: security-relevant logs (auth, admin actions, access to customer data) typically need 90 days to a year of hot retention with longer cold storage, while high-volume debug logs can retire faster. Include correlation identifiers (request ID, user ID, session ID) consistently across services so an investigator can reconstruct a single user session across the application, database, and infrastructure layers without manual log-stitching. Keep clocks synchronized via NTP across all hosts — a five-minute clock skew during a real investigation can make correlating events across systems effectively impossible, and it's a trivial, low-cost control to get right.

Audit tip: Ask to see who currently holds delete or write-suppress permissions on the log pipeline itself, then pull a real log entry for a privileged action (e.g. an IAM policy change) and show its timestamp lines up with the change ticket. Auditors weight log integrity controls more heavily than log volume.

Common gaps

• Application logs are captured but authentication events from the identity provider or database audit logs are never forwarded into the same pipeline, leaving blind spots during investigations
• Engineers with production database access also hold delete permissions on the logging platform, so a compromised or malicious insider could erase their own trail
• Retention is set to the logging vendor's default (often 15-30 days) rather than a deliberate period tied to the incident-response and legal-hold needs of the business

Related

Primary sources

• ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.8.15)