A.8.15 Audit Checklist

When to use this

Use this checklist during an internal audit of log generation, storage, protection, retention, analysis, alerting, and corrective action.

Related controls

• A.8.15 Logging
• A.8.15 Audit Evidence Pack
• Logging and Monitoring Standard
• Log Source and Retention Register
• Log Review and Alert Triage Record
• Log Integrity and Access Review Checklist

Audit checklist

• Review logging policy or standard.
• Review log source and retention register.
• Sample logs for required event detail.
• Check privileged activity logging.
• Check log protection from tampering/deletion.
• Review SIEM/log analysis coverage and rules.
• Review alert triage records.
• Check separation of duties for log review.
• Review fault trend analysis and corrective action.
• Check cloud/managed service logging levels where applicable.

Findings table