CIS Control 8 Safeguards for audit logging: the log management process, log collection and storage, time synchronization, detailed, DNS, URL and command-line logs, centralization, retention, review and service provider logs.
The documented audit log management process that sets logging requirements for collection, review and retention, reviewed annually: the Govern Safeguard that Control 8's collection Safeguards follow.
Enabling audit logging across enterprise assets as the audit log management process requires: the IG1 collection baseline that the IG2 logging Safeguards extend.
Making sure logging destinations have enough storage capacity to meet the audit log management process: the storage side of IG1 logging.
Consistent time across enterprise assets using at least two synchronized time sources where supported, so that log timestamps can be correlated across systems.
Detailed, forensics-ready audit logging on assets that hold sensitive data, capturing fields such as event source, date, username, timestamp and source and destination addresses.
Logging DNS queries on enterprise assets where appropriate and supported: one of three IG2 Safeguards in Control 8 that add a specific log source (DNS, URL requests and command lines).
Logging URL requests from enterprise assets where appropriate and supported, giving visibility into web activity for detection and investigation.
Logging command-line activity, for example from Bash, PowerShell and remote administrative terminals.
Centralizing the collection and storage of audit logs from enterprise assets as far as possible, for example in a SIEM, following the documented audit log management process.
Keeping audit logs across enterprise assets for at least 90 days: the Control 8 Safeguard with a fixed retention minimum, measured on the log aggregation tools from Safeguard 8.9.
Weekly or more frequent reviews of audit logs to spot anomalies or abnormal events that could signal a threat, and how assessors measure the interval between reviews.
Collecting logs from service providers where supported, covering events such as sign-ins, authorization decisions, user management and data creation or disposal: the IG3 Safeguard in Control 8.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.