What it asks for. This control expects logs that record activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. The purpose is to record events, generate evidence, protect the integrity of log information and support investigations.
In practice. Good practice means deciding which events to log for each system, including user and administrator actions, authentication and security events, then collecting logs centrally with accurate time stamps. Logs are protected against tampering and retained for a defined period. Auditors look for a logging standard, evidence of collection from key systems, retention settings and reviews of logs.
Common gaps. Typical gaps are missing logs from cloud and SaaS services, retention too short for investigations and logs collected but never analysed. Clock synchronisation problems also make it hard to correlate events across systems.