ISO 27001 audit logging requirements (A.8.15) and how to satisfy them

The control

A.8.15 is usually tested alongside A.8.16 (monitoring activities) and A.5.28 (collection of evidence): the certification auditor wants to see not just that logs exist, but that someone actually looks at them and that they'd hold up as evidence if needed.

What an auditor asks for

An ISO 27001 certification auditor samples your logging control directly: do logs exist for the events your risk assessment says matter, are they protected from modification, and can you produce them as evidence on request. "We log things" without a protected, produceable record doesn't pass a Stage 2 audit.

Retention requirement

AuditRails retains ISO 27001 audit logs for a minimum of 3 years by default. Retention extends automatically if you're also subscribed to a framework with a longer requirement.

What AuditRails captures

Access-control events capture the privilege and justification context A.8.15's "protected and analyzed" expectation implies, not just a bare grant/revoke record.

import { AuditRails } from '@auditrails/node';

const audit = new AuditRails({ apiKey: 'at_live_...' });

await audit.log({
  action: 'access.granted',
  actor_id: '...', // required
  resource: '...', // required
  metadata: {
    role: '...', // optional
    granted_by: '...', // optional
    justification: '...', // optional
    privileged: '...', // optional
  }
});

What you hand your auditor

Generate an evidence bundle for your audit window and you get a zip containing a PDF summary report, the full event log as NDJSON, and a manifest with SHA-256 checksums of both files plus a hash-chain proof: exactly the kind of produceable, protected evidence a Stage 2 certification audit or a surveillance audit asks for.

Common ways teams fail this control

• Logs that exist but were never reviewed or analyzed. A.8.15 explicitly says "analyzed", and an auditor who asks who reviews these and gets no answer will flag it.
• No protection against logs being edited by the same administrators the logging is meant to hold accountable. A.8.15's "protected" requirement expects separation, not just existence.
• Logging infrastructure changes but not access events, leaving out exactly the control (who accessed what, when) most Annex A controls actually depend on.
• Retention shorter than 3 years, missing the log-availability window most certification bodies expect to sample from during a surveillance audit.
• No consistent actor_id or timestamp precision across systems, making it impossible to correlate an event across the multiple logging sources most ISMS scopes actually include.

Frequently asked questions

This page describes regulatory obligations for information purposes and does not constitute legal advice. Whether they apply to your organisation should be confirmed with your own advisers.