Frameworks / ISO 27001:2022 / 8.15 ISO 27001:2022
Technological controls – ISO 27001:2022
ISO 27001:2022 8.15: Logging Logs recording activity, exceptions, faults and other events of interest are to be generated, kept, protected and analysed. Purpose (stated in ISO/IEC 27002:2022): records events, generates evidence, protects log integrity, identifies security events and supports investigations. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.15.
Maintained by Gerard Blokdyk · Verified against the published standard 18 August 2026 · Control text last updated 25 September 2026 What else in your programme already covers this This control maps to 197 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
10.2.1 10.2.1 Audit logging enabled on all system components 10.2.1.1 10.2.1.1 Logs capture individual user access to cardholder data 10.2.1.2 10.2.1.2 Logs capture all administrative actions 10.2.1.3 10.2.1.3 Access to the audit logs is itself logged 10.2.1.4 10.2.1.4 Logs capture invalid logical access attempts 10.2.1.5 10.2.1.5 Logs capture changes to identification and authentication credentials 10.2.1.6 10.2.1.6 Logs capture initialization and stopping of audit logs 10.2.1.7 10.2.1.7 Logs capture creation and deletion of system-level objects 10.2.2 10.2.2 Required details recorded for each auditable event 10.3.1 10.3.1 Audit log read access limited to job need 10.3.2 10.3.2 Audit log files protected from modification 10.3.3 10.3.3 Audit logs promptly backed up to central secure storage 10.3.4 10.3.4 File integrity monitoring on audit logs 10.4.1 10.4.1 Daily review of security-relevant logs 10.4.2 10.4.2 Periodic review of all other system component logs 10.5.1 10.5.1 Keep logs 12 months, latest three months online 10.6.3 10.6.3 Time sync configuration and time data protected 10.7.1 10.7.1 Service providers detect critical control failures (superseded) 10.7.2 10.7.2 Detect and alert on critical security control failures 11.6.1 11.6.1 Payment page tamper detection 12.4.1 12.4.1 Executive responsibility for a PCI DSS compliance program 5.3.4 5.3.4 Anti-malware audit logs enabled and retained AC-2(12) Account Monitoring for Atypical Usage AC-2(4) Automated Audit Actions AU-12 Audit Record Generation AU-2 Event Logging AU-3 Content of Audit Records AU-3(1) Additional Audit Information AU-4 Audit Log Storage Capacity AU-5 Response to Audit Logging Process Failures AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records (CM-5(1)) IR-4(1) Automated Incident Handling Processes IR-6(1) Automated Reporting IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) SA-1 Policy and Procedures SI-11 Error Handling SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(5) System-Generated Alerts AC-2(12) Account Monitoring for Atypical Usage AC-2(4) Automated Audit Actions AU-12 Audit Record Generation AU-2 Event Logging AU-3 Content of Audit Records AU-3(1) Additional Audit Information AU-4 Audit Log Storage Capacity AU-5 Response to Audit Logging Process Failures AU-6(3) Correlate Audit Record Repositories AU-7 Audit Record Reduction and Report Generation CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records (CM-5(1)) IR-4(1) Automated Incident Handling Processes IR-6(1) Automated Reporting IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) SA-1 Policy and Procedures SI-11 Error Handling SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16)) SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(5) System-Generated Alerts CIS-1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory CIS-12.5 Centralize Network Authentication, Authorization, and Auditing (AAA) CIS-13.1 Centralize Security Event Alerting CIS-13.6 Collect Network Traffic Flow Logs CIS-16.11 Leverage Vetted Modules or Services for Application Security Components CIS-3.14 Log Sensitive Data Access CIS-5.1 Establish and Maintain an Inventory of Accounts CIS-8.1 Establish and Maintain an Audit Log Management Process CIS-8.10 Retain Audit Logs CIS-8.11 Conduct Audit Log Reviews CIS-8.12 Collect Service Provider Logs CIS-8.2 Collect Audit Logs CIS-8.3 Ensure Adequate Audit Log Storage CIS-8.5 Collect Detailed Audit Logs CIS-8.6 Collect DNS Query Audit Logs CIS-8.7 Collect URL Request Audit Logs CIS-8.8 Collect Command-Line Audit Logs CIS-8.9 Centralize Audit Logs SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents SOC2-P6.2 P6.2 Record of authorised disclosures SOC2-PI1.2 PI1.2 Controls over system inputs SOC2-PI1.3 PI1.3 Controls over system processing SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs 6.9 Operations security 6.9.4 Logging and monitoring 7.2.8 Records related to processing PII 7.3.10 Automated decision making 7.3.8 Providing copy of PII processed 7.4.3 Accuracy and quality 7.5.4 Records of PII disclosure to third parties NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.AE-03 Information is correlated from multiple sources NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools NIST-CSF-DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved ASBv3-DS-7 Enable logging and monitoring in DevOps ASBv3-GS-7 Define and implement logging, threat detection and incident response strategy ASBv3-LT-6 Configure log storage retention LT-3 Enable logging for security investigation LT-4 Enable network logging for security investigation LT-5 Centralize security log management and analysis C5-DEV-07 Logging of changes C5-OPS-10 Logging and Monitoring - Concept C5-OPS-11 Logging and Monitoring - Metadata Management Concept C5-OPS-12 Logging and Monitoring - Access, Storage and Deletion C5-OPS-14 Logging and Monitoring - Storage of the Logging Data C5-OPS-15 Logging and Monitoring - Accountability E8-ADMIN-ML2 Restrict Administrative Privileges (ML2) E8-APP-ML2 Application Control (ML2) E8-UAH-ML3 User Application Hardening - Maturity Level 3 DSS01.03 DSS01.03 Monitor I&T infrastructure DSS05.07 DSS05.07 Manage vulnerabilities and monitor the infrastructure for security-related events DSS06.05 DSS06.05 Ensure traceability and accountability for information events ASD37-30 Endpoint detection and response (Very Good) ASD37-33 Capture network traffic (Limited) SEC04-BP01 Configure service and application logging SEC04-BP02 Capture logs, findings, and metrics in standardized locations 7.5.3 Control of documented information 9.1 Monitoring, measurement, analysis and evaluation A.6.2.8 AI system recording of event logs A.7.5 Data provenance ANSSI-HYG-36 Enable and Configure Logging on the Most Important Components AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment Art.23.4.b Submit an incident notification within 72 hours, with an initial assessment and indicators of compromise 3.11.3e Advanced Automation and Analytics Capabilities Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Technological controls – ISO 27001:2022 You are reading one control. How much of ISO 27001:2022 have you already done? ISO 27001:2022 8.15 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 197 it maps to, and the evidence behind each claim, over MCP and REST.