[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-15":3},{"item":4,"lessons":16,"controls":58,"related":85},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-15","Annex A 8.15","ISO\u002FIEC 27001:2022 Annex A 8.15: Logging",10,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects logs that record activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. The purpose is to record events, generate evidence, protect the integrity of log information and support investigations.\n\n**In practice.** Good practice means deciding which events to log for each system, including user and administrator actions, authentication and security events, then collecting logs centrally with accurate time stamps. Logs are protected against tampering and retained for a defined period. Auditors look for a logging standard, evidence of collection from key systems, retention settings and reviews of logs.\n\n**Common gaps.** Typical gaps are missing logs from cloud and SaaS services, retention too short for investigations and logs collected but never analysed. Clock synchronisation problems also make it hard to correlate events across systems.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54],{"slug":19,"title":20,"published_at":21},"spains-aepd-rules-ministry-of-defence-violated-gdpr-by-withholding-health-data-access-logs","Spain's AEPD Rules Ministry of Defence Violated GDPR by Withholding Health Data Access Logs","2026-09-15T18:21:41.527+00:00",{"slug":23,"title":24,"published_at":25},"italian-dpa-finds-hospital-exposed-patient-records-through-weak-access-controls-and-logging","Italian DPA Finds Hospital Exposed Patient Records Through Weak Access Controls and Logging","2026-09-15T17:20:28.888+00:00",{"slug":27,"title":28,"published_at":29},"italian-health-agency-fined-24k-for-lax-ehr-access-controls-and-insufficient-audit-logging","Italian Health Agency Fined €24K for Lax EHR Access Controls and Insufficient Audit Logging","2026-09-14T14:22:22.466+00:00",{"slug":31,"title":32,"published_at":33},"spains-aepd-finds-ministry-of-defence-violated-gdpr-patient-data-access-rights","Spain's AEPD Finds Ministry of Defence Violated GDPR Patient Data Access Rights","2026-09-10T16:21:15.194+00:00",{"slug":35,"title":36,"published_at":37},"gdpr-fine-issued-after-cyberattack-exposes-inadequate-security-controls","GDPR Fine Issued After Cyberattack Exposes Inadequate Security Controls","2026-09-08T16:20:19.878+00:00",{"slug":39,"title":40,"published_at":41},"french-hospital-fined-500k-after-524k-patient-records-exposed-via-weak-remote-access","French Hospital Fined €500K After 524K Patient Records Exposed via Weak Remote Access","2026-09-03T14:22:07.409+00:00",{"slug":43,"title":44,"published_at":45},"romanian-cosmetics-retailer-fined-5000-for-inadequate-security-controls-after-cyberattack","Romanian Cosmetics Retailer Fined €5,000 for Inadequate Security Controls After Cyberattack","2026-09-03T14:21:49.547+00:00",{"slug":47,"title":48,"published_at":49},"exfilsquad-leaks-100000-uk-police-records-in-pnld-breach","ExfilSquad Leaks 100,000+ UK Police Records in PNLD Breach","2026-08-03T16:20:41.584+00:00",{"slug":51,"title":52,"published_at":53},"ten-month-breach-of-south-koreas-diplomatic-academy-exposes-6000-staff-records","Ten-Month Breach of South Korea's Diplomatic Academy Exposes 6,000 Staff Records","2026-07-22T22:21:09.049+00:00",{"slug":55,"title":56,"published_at":57},"insider-misuse-of-customer-data-earns-romanian-bank-gdpr-fine","Insider Misuse of Customer Data Earns Romanian Bank GDPR Fine","2026-07-03T16:20:23.913+00:00",[59,64,69,73,77,81],{"slug":60,"name":61,"problem":62,"stories":63},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",5,{"slug":65,"name":66,"problem":67,"stories":68},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,{"slug":70,"name":71,"problem":72,"stories":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":74,"name":75,"problem":76,"stories":68},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":78,"name":79,"problem":80,"stories":68},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":82,"name":83,"problem":84,"stories":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[86,92,97,102,107,112,117,121],{"family":87,"item":88,"code":89,"title":90,"together":91},"cis","8","Control 8","Audit Log Management",9,{"family":93,"item":94,"code":95,"title":95,"together":96},"itil","overview","ITIL",8,{"family":98,"item":99,"code":100,"title":101,"together":96},"nist-800-53","ac-2","AC-2","Account Management",{"family":87,"item":103,"code":104,"title":105,"together":106},"6","Control 6","Access Control Management",7,{"family":108,"item":109,"code":110,"title":111,"together":106},"gdpr","32","Article 32","Security of processing",{"family":108,"item":113,"code":114,"title":115,"together":116},"5","Article 5(1)(f)","Principles relating to processing of personal data",6,{"family":98,"item":118,"code":119,"title":120,"together":116},"au-2","AU-2","Event Logging",{"family":108,"item":122,"code":123,"title":124,"together":63},"33","Article 33","Notification of a personal data breach to the supervisory authority"]