A.8.15 Technological
Logging
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (14)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AU-2mostlyaligns with — Both controls define the events and activities that must be captured in logs to support accountability and incident investigation.
- AU-3mostlyaligns with — Both specify the minimum data elements that each logged event must contain to enable reconstruction and correlation of security-relevant actions.
- AU-9mostlyaligns with — Both require technical and procedural safeguards to prevent unauthorized modification or deletion of audit records, including by privileged users.
- AU-11partialaligns with — Both address retention and archival of log data when required for regulatory, evidentiary, or operational purposes.
- AU-6partialaligns with — Both emphasize systematic review and analysis of logged events to detect anomalies, indicators of compromise, and support incident response.
- AU-8partialaligns with — Both stress the need for synchronized, accurate time stamps across systems so that logs can be reliably correlated during analysis and investigations.
Aligned NIST CSF 2.0 outcomes (13)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.PS-04fullcovers — The ISO control mandates generation and protection of event logs that capture user, system, and security-relevant activity, directly satisfying the CSF requirement to produce logs for continuous monitoring.
- DE.AE-02mostlyaligns with — The control’s emphasis on log analysis to detect unusual or anomalous behaviour supports the CSF goal of analyzing potentially adverse events to understand associated activities.
- DE.AE-03mostlyaligns with — Requiring synchronized time sources and correlation of logs across systems enables the CSF outcome of correlating information from multiple sources to understand adverse events.
- DE.CM-01partialaligns with — By generating logs of network-related events and access attempts, the control contributes to the CSF outcome of monitoring networks and services for potentially adverse events.
- DE.CM-03partialaligns with — Logging of user activities, privilege use, and identity changes provides the data needed to monitor personnel activity and technology usage for adverse events.
- ID.RA-01partialaligns with — Analysis of logged security events can reveal vulnerabilities or misconfigurations that need to be identified, validated, and recorded.
- RS.AN-03partialaligns with — Preserved and protected logs supply the detailed event data required for post-incident analysis to determine what occurred and identify root cause.
Related OWASP ASVS 5.0 requirements (16)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V16.2.2fullaligns with — ISO’s explicit call for synchronized time sources across systems implements the ASVS requirement that timestamps in security logs use a consistent, synchronized time base (UTC or offset) to enable correlation.
- V16.2.1mostlyaligns with — The ISO requirement to capture user IDs, system activities, dates/times, device and network identifiers for each event directly supports the ASVS mandate that every log entry contain the metadata needed for detailed security investigations.
- V16.3.1mostlyaligns with — Logging of successful and rejected system access attempts, privilege use, and identity changes satisfies the ASVS requirement to record all authentication operations with relevant metadata.
- V16.4.2mostlyaligns with — ISO’s controls preventing privileged users from deleting or altering their own logs and protecting against unauthorized log changes implement the ASVS requirement that logs be protected from unauthorized access and modification.
- V16.2.5partialaligns with — ISO’s recognition that logs may contain sensitive or PII data and the call for privacy-protection measures aligns with the ASVS requirement to enforce logging rules based on data-protection levels.
- V16.3.2partialaligns with — ISO’s requirement to log successful and rejected data/resource access attempts partially fulfills the ASVS need to log failed (and, at L3, all) authorization decisions.
- V16.3.3partialaligns with — The ISO directive to log security-system activations, configuration changes, and attempts to bypass controls aligns with the ASVS requirement to log both defined security events and bypass attempts.
- V16.4.3partialaligns with — ISO’s guidance on sending logs to a separate system for analysis, detection and alerting partially satisfies the ASVS requirement for secure, logically separate log transmission and storage.
Related weaknesses / CWE (63)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1050→PCWE-117←PCWE-125→PCWE-1274→PCWE-1295←P →PCWE-1320←PCWE-1323←P →PCWE-200→PCWE-202←P →PCWE-209←PCWE-210←P →PCWE-222←P →PCWE-223←P →FCWE-269→PCWE-284→PCWE-360←P →PCWE-385←PCWE-390←P →PCWE-392←PCWE-400→PCWE-406→PCWE-507→PCWE-509→PCWE-511→PCWE-515←P →PCWE-532→MCWE-535←P →PCWE-550←PCWE-69←P →PCWE-74→PCWE-75→PCWE-754→PCWE-755←P →PCWE-778→FCWE-779←P →MCWE-91→P
Why these map — AI rationale (under review)
- CWE-223fullprevents — Logging directly requires recording security-relevant events that the weakness omits.
- CWE-778fullprevents — Mandating comprehensive event logging with user IDs, timestamps, and access attempts directly eliminates the absence of audit trails that would otherwise allow undetected exploitation.
- CWE-532mostlyprevents — Requiring de-identification and privacy controls before logs leave the organization reduces the chance that sensitive data inadvertently captured in logs becomes exposed to external parties.
- CWE-779mostlyprevents — A.8.15 directly requires logging to be configured so that only necessary events are recorded, preventing excessive data.
- CWE-1050partialfinds — Logging may detect excessive consumption but does not stop the loop.
- CWE-125partialfinds — Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.
- CWE-1274partialfinds — Logging can detect unauthorized writes to volatile memory but does not prevent the weakness.
- CWE-1295partialprevents — Logging control requires that only necessary information is recorded, directly mitigating debug messages that leak sensitive data.
- CWE-1323partialprevents — Logging controls define where and how trace data may be stored.
- CWE-200partialfinds — Cryptographic hashing, append-only storage, and access restrictions on log files limit an attacker’s ability to read or tamper with recorded sensitive information.
- CWE-202partialfinds — Logging query activity supports detection of inference attempts after the fact.
- CWE-210partialprevents — Logging policy can require suppression of sensitive data in error messages.
- CWE-222partialprevents — Logging ensures security-relevant events are recorded without truncation that could hide attack details.
- CWE-269partialfinds — Logging every use of privileges and protecting those records makes it harder for an attacker who has obtained elevated rights to operate without leaving evidence.
- CWE-284partialfinds — Forbidding privileged users from deleting or altering their own logs prevents abuse of elevated rights to conceal unauthorized actions.
- CWE-360partialfinds — Logging can capture event data but does not inherently validate its authenticity against spoofing.
- CWE-390partialfinds — Logging captures error conditions but does not guarantee subsequent handling or remediation.
- CWE-400partialfinds — Specifying log storage limits and rotation procedures reduces the risk that unbounded log growth will exhaust disk or memory resources and cause denial of service.
- CWE-406partialfinds — Logging provides visibility into high-volume traffic but does not itself limit or control it.
- CWE-507partialfinds — Logging can detect Trojan Horse activity after the fact but does not prevent its presence.
- CWE-509partialfinds — Logging supports detection of malware activity and replication attempts.
- CWE-511partialfinds — Logging can record execution of time- or logic-triggered code, aiding detection after the fact.
- CWE-515partialfinds — Logging may record covert storage activity but does not prevent the channel itself.
- CWE-535partialmitigates — Logging can capture error messages but does not prevent their exposure to users.
- CWE-69partialfinds — Logging of file-system events can record ADS access attempts, aiding detection, but does not prevent the weakness itself.
- CWE-74partialfinds — Logging supports detection of injection attempts but does not prevent the weakness.
- CWE-75partialfinds — Logging can record injection attempts for detection but does not prevent the weakness.
- CWE-754partialfinds — Logging can record unhandled exceptions but does not prevent the weakness itself.
- CWE-755partialfinds — Logging captures unhandled exceptions, aiding detection but not preventing the weakness.
- CWE-91partialfinds — Logging can record injection attempts for detection but does not prevent the weakness.
- CWE-113nonenone — Logging of HTTP traffic can record header-splitting attempts, aiding detection and forensics.
- CWE-117nonenone — Logging control directly requires proper log generation and handling, which mitigates improper output neutralization.
- CWE-1304nonedetects — Logging can record power events but does not ensure or verify configuration integrity.
- CWE-1320nonenone — Logging of error and alert signals supports detection of tampering or suppression.
- CWE-205nonenone — Logging may record behavioral events but does not prevent the weakness from occurring.
- CWE-209nonenone — Logging policy can require suppression of sensitive data in error messages.
- CWE-215nonenone — Logging controls may capture debug output, but do not prevent its creation.
- CWE-385nonedetects — Detailed logging can reveal timing anomalies but does not prevent covert timing channels.
- CWE-391nonenone — Logging captures unhandled errors but does not prevent them.
- CWE-392nonenone — Logging of errors and exceptions helps ensure that error conditions are captured and reported.
- CWE-550nonenone — Logging policy can require suppression of sensitive data in error responses.
- CWE-645nonenone — Logging of authentication events enables detection of lockout abuse but does not prevent the weakness itself.
- CWE-807nonedetects — Logging may record the flawed decisions but does not prevent them.
- CWE-912nonenone — Logging may record hidden functionality activity but does not prevent or detect its existence.
Mitigated MITRE ATT&CK techniques (8)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1021mostlydetects — Recording remote-service connections, privilege escalations, and network-address details helps identify lateral-movement activity over protocols such as RDP or SMB.
- T1059mostlydetects — Logging of command interpreters, utility programs, and user transactions provides visibility into interactive or scripted adversary commands.
- T1070mostlyprevents — Centralized, tamper-protected logs make it harder for an adversary to erase or alter evidence of their actions across multiple event types.
- T1078mostlydetects — Detailed logging of successful and failed access attempts, privilege use, and identity changes enables detection of unauthorized account usage.
- T1003partialdetects — Recording privileged utility execution, file access, and system configuration changes can reveal attempts to dump credentials from memory or registry stores.
- T1110partialdetects — Systematic logging of rejected access attempts and authentication events supports detection of password-guessing or spraying campaigns.
- T1543partialdetects — Creation or modification of system services and processes is captured in configuration-change and privilege-use logs, exposing persistence mechanisms.
- T1569partialdetects — Logging service-creation events and the execution of system utilities reveals attempts to abuse legitimate services for code execution.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A09mostlyprevents — Comprehensive event logging with protected, tamper-evident records and centralized analysis directly enables detection, investigation, and response to security incidents that would otherwise go unnoticed.
- A01partialfinds — Detailed logs of access attempts, privilege use, and configuration changes create an audit trail that can reveal and deter unauthorized access or privilege abuse after the fact.
- A02partialfinds — Recording system configuration changes and security control activations provides evidence that can highlight misconfigurations or unauthorized alterations introduced during operations.
- A07partialfinds — Logging of successful and rejected authentication events supplies the forensic data needed to identify authentication bypasses or brute-force attempts after they occur.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.