Configure log generation across all sources per NIST SP 800-92 Chapter 2 (Log Categories) + Chapter 3 (Log Management Infrastructure) + Chapter 5 (Log Management Operational Processes). Operating system log generation per Section 2.2.1: enable and configure system logs (Windows Event Log + Linux syslog/journald + macOS unified log + Solaris audit) capturing authentication + privilege use + system events + service starts/stops + audit events. Application and service logging per Section 2.2.2: enable application audit logs covering authentication + authorisation + transactions + errors + administrative actions with consistent format and identifiers across the application portfolio. Security tool logging per Section 2.2.3: include firewall + IDS/IPS + antivirus + EDR + vulnerability scanners + DLP + WAF + identity broker + secrets management + cloud security posture + container runtime + similar. Network device logging per Section 2.2.4: router + switch + WAP + load balancer logs covering authentication + configuration change + interface state + ACL match + packet drop where appropriate. Cloud and SaaS log generation: enable provider audit logs (AWS CloudTrail + Azure Activity + GCP Cloud Audit Logs + M365 Unified Audit + Google Workspace + Salesforce + similar) covering identity + administrative + data access events. Required event content per Section 2.3: timestamp (with timezone) + event source + event type + user/principal + asset + action + outcome + relevant context fields + correlation identifier where applicable.
This control maps to 14 controls across 9 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 14 it maps to, and the evidence behind each claim, over MCP and REST.