Log Integrity and Access Review Checklist

When to use this

Use this checklist to review whether logs are protected against unauthorized modification, deletion, redirection, shutdown, and overwrite.

Related controls

• A.8.15 Logging
• A.8.2 Privileged Access Rights
• A.5.28 Collection of Evidence

Checklist

• Logs are sent to protected storage where feasible.
• Source-system administrators cannot silently alter or delete logs.
• Logging configuration changes require authorization.
• Log deletion requires authorization and creates a record.
• Logging shutdown or redirection is controlled.
• Log overwrite generates alert before loss.
• Time synchronization is sufficient for investigation.
• Log access is reviewed.

Findings table