What it asks for. Audit information and logging tools must be protected from unauthorised access, modification and deletion, and personnel must be alerted when this happens.
In practice. This means forwarding logs promptly to a central platform with restricted administrative access, using immutable or write-once storage for critical logs, separating log administration from system administration and alerting on logging being stopped or cleared. Auditors look for access lists for the logging platform, retention and immutability settings and alerts on log tampering. Backups of log data should be protected in the same way as the live store.
Common gaps. Logs held only on the systems that generate them can be wiped by an attacker. Administrators of production systems often also have full rights over the logging platform. Retention may also be set too short to support investigations that start weeks after the intrusion.