CIS Controls v8 CIS-8.12: Collect Service Provider Logs

What else in your programme already covers this

This control maps to 29 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 5 controls

NIST800-AU-12 AU-12 Audit Record Generation
NIST800-AU-16 AU-16 Cross-organizational Audit Logging
NIST800-AU-2 AU-2 Event Logging
NIST800-IR-5 IR-5 Incident Monitoring
NIST800-SA-9 SA-9 External System Services

SOC 2 · 4 controls

SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13)
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk

NIST SP 800-161 Rev 1 · 3 controls

161R1-AU-12 Audit Record Generation
161R1-AU-16 Cross-Organizational Audit Logging
161R1-AU-2 Event Logging

HIPAA Security Rule · 2 controls

164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

ISO 27001:2022 · 2 controls

5.22 Monitoring, review and change management of supplier services
8.15 Logging

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

PCI DSS 4.0 · 2 controls

12.4.1 12.4.1 Executive responsibility for a PCI DSS compliance program
12.8.5 12.8.5 Responsibility allocation between entity and TPSPs

AWS Well-Architected Security Pillar · 1 control

SEC04-BP01 Configure service and application logging

Australian Information Security Manual · 1 control

ISM-1573 Access to provider logs

Azure Security Benchmark · 1 control

LT-3 Enable logging for security investigation

C5 (Germany) · 1 control

C5-SSO-04 Monitoring of compliance with requirements

FedRAMP High · 1 control

SA-9 External System Services

ISO 27002:2022 · 1 control

5.22 Monitoring, review and change management of supplier services

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-DE.CM-06 External service provider activities and services are monitored to find potentially adverse events

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-8.12 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gaps If you hold FedRAMP Moderate62.7% covered · 57 gaps If you hold NIST SP 800-53 Rev 557.5% covered · 65 gaps If you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gaps If you hold ISO 27002:202249.7% covered · 77 gaps If you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free