What it asks for. This control expects organisations to collect, review and retain audit logs that can help detect, understand and recover from an attack. It covers deciding what to log, keeping time synchronised, storing logs centrally and retaining them long enough.
In practice. There is a logging standard that names required sources and event types, such as authentication, privilege use, DNS and command line activity, with logs forwarded to a central platform protected from tampering. Clocks are synchronised, retention meets both investigation and legal needs, and logs are actually reviewed through alerting and periodic analysis. Evidence includes the logging standard, source coverage lists, retention settings and records of reviews.
Common gaps. Logs are frequently collected but never reviewed, or key sources such as cloud control planes and SaaS audit logs are missing. Retention is often too short to support investigations of intrusions discovered months later.