How to Audit ISO 27001 Annex A 8.15: Logging

In this ultimate how to audit guide to ISO 27001 Annex A 8.15 Logging, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 8.15 Logging Audit Checklist

Auditing ISO 27001 Annex A 8.15 Logging is the systematic technical verification of the generation, protection, and analysis of security event logs. The Primary Implementation Requirement is centralised, immutable log storage with automated correlation, providing the Business Benefit of rapid incident detection and indisputable forensic evidence during security investigations.

This technical verification framework is designed for lead auditors to establish the integrity and completeness of event logging within the ISMS. Use this checklist to validate compliance with ISO 27001 Annex A 8.15.

1. Log Generation Scope Alignment Verified

Verification Criteria: Event logs are generated for all security-relevant events including user access, privileged actions, system failures, and security alerts across the infrastructure.

Required Evidence: Configuration files or policy documents defining the specific event IDs and log levels (e.g., Information, Warning, Error) captured.

Pass/Fail Test: If critical systems (e.g., production databases or firewalls) are not generating logs for administrative login attempts, mark as Non-Compliant.

2. Log Attribute Completeness Confirmed

Verification Criteria: Each log entry contains sufficient detail to facilitate an investigation, including User ID, event type, date/time, success/failure status, and source/destination identifiers.

Required Evidence: Raw log samples from the SIEM or central log repository demonstrating the presence of all required metadata fields.

Pass/Fail Test: If log entries lack a unique identifier for the user or the specific system that generated the event, mark as Non-Compliant.

3. Centralised Log Repository Implementation Validated

Verification Criteria: Logs are transmitted from local assets to a centralised, dedicated log management system or SIEM in near real-time.

Required Evidence: Architecture diagram and data ingestion logs from the central repository (e.g., Splunk, Sentinel, ELK).

Pass/Fail Test: If security logs are only stored locally on the originating server with no off-site or centralised backup, mark as Non-Compliant.