Frameworks / CIS Controls v8 / CIS-8.9 CIS Controls v8
CIS Control 8: Audit Log Management
CIS Controls v8 CIS-8.9: Centralize Audit Logs As far as practical, bring the gathering and keeping of audit logs from enterprise assets into one central place.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 89 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AU-3 Content of Audit Records AU-4 Audit Log Storage Capacity AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation AU-7(1) Automatic Processing AU-9 Protection of Audit Information CA-7 Continuous Monitoring CM-6(1) Automated Management, Application, and Verification IR-4(1) Automated Incident Handling Processes IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) MA-4 Nonlocal Maintenance PE-16 Delivery and Removal SA-2 Allocation of Resources SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-7(7) Integration of Detection and Response AU-3 Content of Audit Records AU-4 Audit Log Storage Capacity AU-6(1) Automated Process Integration AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation AU-7(1) Automatic Processing AU-9 Protection of Audit Information CA-7 Continuous Monitoring CM-6(1) Automated Management, Application, and Verification IR-4(1) Automated Incident Handling Processes IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) MA-4 Nonlocal Maintenance PE-16 Delivery and Removal SA-2 Allocation of Resources SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-7(7) Integration of Detection and Response 1.2.8 1.2.8 NSC configuration files secured and consistent 10.2.1.2 10.2.1.2 Logs capture all administrative actions 10.3.2 10.3.2 Audit log files protected from modification 10.3.3 10.3.3 Audit logs promptly backed up to central secure storage 10.7.1 10.7.1 Service providers detect critical control failures (superseded) 10.7.2 10.7.2 Detect and alert on critical security control failures 12.4.1 12.4.1 Executive responsibility for a PCI DSS compliance program 8.2.7 8.2.7 Third-party remote access accounts controlled 6.5.2 6.5.2 Confirm PCI DSS controls after significant change E8-ADMIN-ML2 Restrict Administrative Privileges (ML2) E8-APP-ML3 Application Control (ML3) E8-UAH-ML3 User Application Hardening - Maturity Level 3 NIST-CSF-DE.AE-03 Information is correlated from multiple sources NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs ISM-1405 Implementing a centralised event logging facility ISM-1983 Timely forwarding to the centralised facility ASBv3-IR-4 Detection and analysis - investigate an incident LT-5 Centralize security log management and analysis C5-OPS-10 Logging and Monitoring - Concept C5-OPS-14 Logging and Monitoring - Storage of the Logging Data ASD37-30 Endpoint detection and response (Very Good) SEC04-BP02 Capture logs, findings, and metrics in standardized locations 8.9 Centralize Audit Logs A.6.2.6 AI system operation and monitoring Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CIS Control 8: Audit Log Management You are reading one control. How much of CIS Controls v8 have you already done? CIS Controls v8 CIS-8.9 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 89 it maps to, and the evidence behind each claim, over MCP and REST.