Audit Logging Policy

Last updated: January 15, 2026

Audit Logging and Monitoring Policy

Document owner: Chief Information Security Officer (CISO), with VP Engineering as co-owner Version: 3.0 Effective date: January 1, 2026 Last updated: January 15, 2026 Classification: Public — Trust Center Review cadence: Annual review; updates for infrastructure changes Company: Acme Cloud, Inc. Address: 1200 Market Street, Suite 400, San Francisco, CA 94103, USA Primary contacts: trust@acmecloud.com | security@acmecloud.com | privacy@acmecloud.com

Definitions and Key Terms

Term	Definition
Audit Log	A chronological record of system activities that provides documentary evidence of the sequence of events
Event	An observable occurrence in a system or network, which may or may not be security-relevant
Security Event	An event that may affect the security of information systems or data
Log Source	A system, application, or device that generates log data
Log Aggregation	The process of collecting logs from multiple sources into a centralized system
SIEM	Security Information and Event Management — technology that provides real-time analysis of security alerts
Log Retention	The period for which log data is stored before deletion or archival
Log Integrity	Ensuring that log data has not been tampered with or modified
Real-Time Monitoring	Continuous observation of systems and events as they occur
Alert	A notification triggered when specific conditions or thresholds are met
Correlation	Analysis of events from multiple sources to identify patterns or incidents
Audit Trail	A complete record of all activities that affect a particular operation, procedure, or event
Privileged Activity	Actions performed by users with elevated access rights or administrative permissions
Access Log	Records of user authentication and authorization activities
Transaction Log	Records of database or application transactions
Change Log	Records of modifications to systems, configurations, or data
Network Log	Records of network traffic and connection activities
Application Log	Records generated by application software
System Log	Records generated by operating systems and infrastructure
Security Log	Records specifically related to security events and activities
Log Format	The structure and syntax used to record log entries
Timestamp	The date and time associated with a log entry
Log Parsing	The process of extracting structured data from log entries
Log Analysis	The process of examining logs to identify patterns, anomalies, or incidents

Scope and Purpose

This Audit Logging and Monitoring Policy establishes Acme Cloud, Inc.'s requirements for generating, collecting, storing, protecting, and analyzing audit logs across all systems, applications, and infrastructure. The policy scope encompasses all production systems, development environments with access to production data, security systems, network infrastructure, cloud services, and third-party integrations that process Acme Cloud or customer data. The purpose is to maintain comprehensive visibility into system activities for security monitoring, incident investigation, compliance demonstration, operational troubleshooting, and forensic analysis.

Logging Objectives

Objective	Description	Benefit
Security Detection	Identify security incidents and threats in real-time	Rapid response
Incident Investigation	Support forensic analysis of security events	Root cause determination
Compliance Evidence	Demonstrate regulatory and contractual compliance	Audit readiness
Accountability	Maintain attribution for all significant actions	Non-repudiation
Operational Visibility	Support system troubleshooting and performance analysis	System reliability
Change Verification	Validate authorized changes; detect unauthorized modifications	Change control

Scope Applicability

System Category	In Scope	Logging Level	Examples
Production Applications	Yes	Comprehensive	SaaS platform, APIs, customer portals
Production Infrastructure	Yes	Comprehensive	AWS resources, databases, network
Security Systems	Yes	Maximum	Authentication, WAF, intrusion detection
Development Environments	Partial	Moderate	Dev/staging with production data access
Internal Tools	Yes	Standard	Admin dashboards, internal apps
Third-Party Services	Yes (via integration)	As available	SaaS vendors, integrations
Employee Devices	Partial	Endpoint telemetry	Laptops (via MDM/EDR)

Logging Requirements

Events Required to Log

Event Category	Required Events	Sensitivity	Examples
Authentication	All authentication attempts (success/failure); session events	High	Login, logout, MFA, SSO
Authorization	Access grants, denials, permission changes	High	RBAC changes, access requests
Data Access	Access to sensitive data; bulk operations	High	Customer data queries, exports
Data Modification	Create, update, delete of sensitive records	High	CRUD on customer data
Administrative Actions	All privileged user activities	Critical	Config changes, user management
Security Events	Alerts, rule triggers, policy violations	Critical	WAF blocks, IDS alerts
System Events	Startup, shutdown, service changes	Medium	Restarts, deployments
Configuration Changes	System and application configuration modifications	High	Settings, feature flags
Network Activity	Connection events, firewall decisions	Medium	VPC flow logs, firewall logs
API Activity	API calls with authentication context	Medium	REST/GraphQL requests
Error Events	Application errors, exceptions	Medium	Unhandled exceptions
Scheduled Tasks	Execution of automated processes	Low	Cron jobs, batch processes

Logging Detail Requirements

Log Element	Required	Format	Purpose
Timestamp	Yes	ISO 8601 (UTC)	Event ordering
Event Type	Yes	Enumerated/structured	Classification
Event Source	Yes	System identifier	Source identification
Actor Identity	Yes	User ID, service account	Attribution
Actor Context	Yes	IP address, session ID	Context
Target Resource	Yes	Resource identifier	Affected object
Action Performed	Yes	Action verb/type	Activity description
Outcome	Yes	Success/failure	Result status
Reason/Details	Conditional	Text/structured	Additional context
Correlation ID	Recommended	UUID	Request tracing
Tenant ID	Yes (multi-tenant)	Tenant identifier	Tenant isolation

Log Format Standards

Standard	Requirement	Implementation
Structured Format	All logs in JSON format	Application logging
UTC Timestamps	All timestamps in UTC	System configuration
Consistent Schema	Follow defined log schemas	Log templates
Correlation Support	Include trace/correlation IDs	Distributed tracing
Tenant Attribution	Include tenant identifier	Application logging
Severity Levels	Use standard severity (DEBUG, INFO, WARN, ERROR, CRITICAL)	Logging framework

Log Categories and Sources

Application Logs

Log Type	Source	Events Captured	Retention
Authentication Log	Auth service	Login, logout, MFA, password changes	12 months
Authorization Log	Application	Permission checks, role assignments	12 months
Audit Log	Application	User actions affecting data	12 months
API Access Log	API gateway	All API requests with auth context	12 months
Error Log	Application	Exceptions, failures, warnings	6 months
Performance Log	APM	Response times, throughput, errors	3 months

Infrastructure Logs

Log Type	Source	Events Captured	Retention
AWS CloudTrail	AWS	All AWS API activity	12 months
VPC Flow Logs	AWS VPC	Network traffic metadata	6 months
ELB Access Logs	AWS ELB	Load balancer access	6 months
RDS Audit Log	AWS RDS	Database activity	12 months
S3 Access Logs	AWS S3	Object access	12 months
CloudWatch Logs	AWS	System and application logs	Per category

Security Logs

Log Type	Source	Events Captured	Retention
WAF Logs	Cloudflare/AWS WAF	Web attack detection, blocks	12 months
IDS/IPS Logs	Security monitoring	Intrusion detection alerts	12 months
EDR Logs	Endpoint protection	Endpoint security events	12 months
SIEM Alerts	Datadog	Correlated security alerts	12 months
Certificate Logs	PKI/TLS	Certificate operations	24 months
Secrets Access	Secrets Manager	Secrets access audit	12 months

Database Logs

Log Type	Database	Events Captured	Retention
Query Audit Log	PostgreSQL	DDL, DML on sensitive tables	12 months
Connection Log	PostgreSQL	Connection attempts	6 months
Error Log	PostgreSQL	Database errors	6 months
Slow Query Log	PostgreSQL	Performance issues	3 months
Replication Log	PostgreSQL	Replication status	3 months

Log Collection and Aggregation

Architecture Overview

Component	Technology	Purpose	Availability
Log Shipping	AWS CloudWatch Agent, Datadog Agent	Collect from sources	24/7
Aggregation	Datadog Log Management	Centralize logs	24/7
SIEM	Datadog Security Monitoring	Security analysis	24/7
Long-Term Storage	AWS S3 (encrypted)	Compliance retention	24/7
Backup	Cross-region S3 replication	Disaster recovery	24/7

Collection Requirements

Requirement	Specification	Rationale
Real-Time Collection	<60 seconds from generation to SIEM	Rapid detection
Reliable Delivery	At-least-once delivery	No log loss
Encryption in Transit	TLS 1.2+ for all log transport	Confidentiality
Compression	Enable compression for high-volume sources	Efficiency
Buffering	Local buffer for network interruptions	Reliability
Health Monitoring	Alert on collection failures	Completeness

Log Pipeline Metrics

Metric	Definition	Target	Alert Threshold
Collection Latency	Time from event to SIEM availability	<60 seconds	>300 seconds
Log Volume	Events per second processed	Baseline ± 50%	>2x or <50%
Parse Failures	Failed log parsing rate	<0.1%	>1%
Storage Utilization	Log storage usage	<80%	>90%
Pipeline Health	Collection agent status	100% healthy	Any unhealthy

Security Monitoring and Alerting

Monitoring Approach

Approach	Description	Use Case
Rule-Based Detection	Predefined rules triggering on specific patterns	Known threats
Threshold Alerting	Alerts when metrics exceed thresholds	Anomaly detection
Correlation	Cross-source event correlation	Complex attacks
Behavioral Analysis	Baseline deviation detection	Unknown threats
Threat Intelligence	IOC matching against known indicators	Emerging threats

Detection Rules Categories

Category	Examples	Priority
Authentication Attacks	Brute force, credential stuffing, impossible travel	Critical
Privilege Escalation	Unauthorized admin access, permission changes	Critical
Data Exfiltration	Bulk data access, unusual download patterns	Critical
Malware Activity	Known malware signatures, C2 communication	Critical
Insider Threat	Unusual data access patterns, policy violations	High
Configuration Changes	Unauthorized config modifications	High
Network Anomalies	Unusual traffic patterns, blocked connections	Medium
Application Errors	Error rate spikes, new error types	Medium

Alert Severity Levels

Severity	Definition	Response SLA	Notification
Critical	Active attack; data compromise likely	15 minutes	PagerDuty immediate
High	Significant security event; investigation required	1 hour	PagerDuty + Slack
Medium	Potential security concern; review needed	4 hours	Slack + email
Low	Informational; trend monitoring	24 hours	Dashboard

Alert Response Requirements

Alert Type	Initial Response	Investigation	Documentation
Critical	Acknowledge within 15 min; begin containment	Full investigation	Incident ticket required
High	Acknowledge within 1 hour; assess scope	Targeted investigation	Incident ticket required
Medium	Acknowledge within 4 hours; review context	As warranted	Log as appropriate
Low	Review during business hours	Trend analysis	None required

Log Protection and Integrity

Log Security Controls

Control	Implementation	Purpose
Encryption at Rest	AES-256 encryption for all stored logs	Confidentiality
Encryption in Transit	TLS 1.2+ for all log transport	Confidentiality
Access Control	RBAC; principle of least privilege	Authorization
Immutability	Write-once storage for compliance logs	Integrity
Separation of Duties	Log administrators ≠ system administrators	Non-repudiation
Tampering Detection	Hash verification; anomaly detection	Integrity

Access Control Matrix

Role	View Logs	Search Logs	Export Logs	Modify Settings	Delete Logs
Security Team	All	All	With approval	Yes	No
SRE Team	Infrastructure	Infrastructure	With approval	Limited	No
Engineering	Application (own team)	Limited	No	No	No
Compliance	Audit logs	Audit logs	With approval	No	No
Executive	Dashboards	No	No	No	No
External Auditor	As provisioned	As provisioned	With approval	No	No

Log Integrity Verification

Verification	Method	Frequency	Owner
Hash Verification	SHA-256 checksums on archived logs	At archive; on access	Automated
Completeness Check	Gap detection in log sequences	Daily	Automated
Tampering Detection	SIEM rule for log modification attempts	Real-time	Security team
Chain of Custody	Documented access for forensic logs	Per investigation	Security team

Retention and Archival

Retention Schedule

Log Category	Hot Storage	Warm Storage	Cold/Archive	Total Retention
Security Events	90 days	9 months	24 months	36 months
Authentication	30 days	11 months	24 months	36 months
Audit Logs	90 days	9 months	24 months	36 months
Application Errors	30 days	5 months	6 months	12 months
API Access	30 days	5 months	6 months	12 months
Infrastructure	30 days	5 months	6 months	12 months
Performance/Debug	7 days	23 days	N/A	30 days

Storage Tiers

Tier	Description	Access Time	Cost	Use Case
Hot	Fully indexed; real-time queries	Milliseconds	High	Active monitoring
Warm	Indexed; slower queries	Seconds	Medium	Investigation
Cold	Archived; retrieval required	Minutes-hours	Low	Compliance retention

Deletion and Disposal

Activity	Requirement	Verification	Documentation
Automated Deletion	Per retention schedule	Deletion logs	Retention policy
Legal Hold	Suspend deletion when required	Hold registry	Legal notice
Manual Deletion	Prohibited except with approval	Audit trail	Exception request
Disposal Verification	Confirm permanent deletion	Deletion certificate	Compliance records

Monitoring Operations

Operational Metrics

Metric	Description	Target	Current
SIEM Availability	Uptime of monitoring platform	99.9%	99.95%
Alert Response Time	Time to acknowledge alerts	<15 min (Critical)	8 min avg
False Positive Rate	Percentage of non-actionable alerts	<20%	18%
Detection Coverage	Percentage of log sources monitored	100%	100%
Rule Effectiveness	Alerts leading to valid investigation	>50%	62%

Review Cadence

Review Activity	Frequency	Owner	Output
Alert Triage	Continuous	Security on-call	Alert disposition
Daily Summary Review	Daily	Security team	Daily brief
Weekly Trend Analysis	Weekly	Security lead	Trend report
Rule Tuning	Monthly	Security team	Rule updates
Retention Audit	Quarterly	Compliance	Audit report
Architecture Review	Annual	Security + Engineering	Improvements

Capacity Planning

Resource	Current Usage	Threshold	Expansion Plan
Log Ingestion	2TB/day	4TB/day	Auto-scaling
Hot Storage	180TB	250TB	Auto-scaling
Query Capacity	70%	85%	Scale monitoring
Archive Storage	1.2PB	2PB	S3 auto-scaling

Numbered Policy Statements

Logging Mandate: All production systems, security systems, and systems processing customer data must generate audit logs capturing security-relevant events.
Centralized Collection: All logs must be collected and aggregated in the centralized logging platform (SIEM) for security monitoring and analysis.
Real-Time Monitoring: Security-relevant logs must be monitored in real-time with automated alerting for critical and high-severity events.
Retention Compliance: Logs must be retained for the periods specified in the retention schedule to meet regulatory, contractual, and forensic requirements.
Log Integrity: Log data must be protected from unauthorized modification or deletion through encryption, access controls, and integrity verification.
Access Control: Access to log data must be restricted based on role and need-to-know, with all access logged for accountability.
Timestamp Accuracy: All logged events must include accurate UTC timestamps synchronized via NTP to enable event correlation.
Structured Logging: Applications must generate structured logs (JSON format) following defined schemas to enable automated analysis.
PII Protection: Logs must not contain unencrypted passwords, tokens, or excessive personal data; sensitive data must be masked or excluded.
Alert Response: Security alerts must be acknowledged and investigated within the timeframes specified by severity level.
Collection Monitoring: Log collection infrastructure must be monitored for failures, with alerts on any gaps in expected log volume.
Legal Hold: Log deletion must be suspended when litigation hold or regulatory preservation requirements are in effect.
Forensic Capability: Log infrastructure must support forensic investigation including secure export, chain of custody, and integrity verification.
Annual Review: Logging requirements, detection rules, and retention policies must be reviewed annually and updated as needed.

Framework Appendix

Compliance Mapping

Requirement	SOC 2 Criteria	ISO 27001 Control	HIPAA Provision	Implementation
Audit logging	CC7.2	A.12.4.1	§164.312(b)	This policy
Log protection	CC7.2	A.12.4.2	§164.312(c)(1)	Integrity controls
Log retention	CC7.2	A.12.4.1	§164.312(b)	Retention schedule
Log review	CC7.2	A.12.4.1	§164.308(a)(1)(ii)(D)	Monitoring operations
Time synchronization	CC7.2	A.12.4.4	§164.312(b)	NTP configuration
Access logging	CC6.1	A.12.4.3	§164.312(b)	Access logs

NIST CSF Mapping

CSF Category	Subcategory	Policy Implementation
DE.AE-3	Event data collected and correlated	Log collection and SIEM
DE.CM-1	Network monitoring	VPC flow logs; network logs
DE.CM-3	Personnel activity monitoring	User activity logs
DE.CM-7	Monitoring for unauthorized access	Authentication logging
PR.PT-1	Audit records determined, documented	This policy
RS.AN-3	Forensics performed	Log retention; integrity

PCI DSS Logging Requirements (Reference)

PCI DSS Requirement	Applicability	Implementation
10.1	Audit trails	Comprehensive logging
10.2	Log specific events	Event requirements matrix
10.3	Log entry content	Log detail requirements
10.4	Time synchronization	UTC timestamps; NTP
10.5	Secure logs	Protection controls
10.6	Log review	Monitoring operations
10.7	Log retention	12-month minimum

Document revision history

Version	Date	Author	Summary of changes
1.0	2024-06-01	Legal & Compliance	Initial Trust Center publication
2.0	2025-03-15	GRC Program	SOC 2 Type II alignment refresh; expanded subprocessors
2.5	2025-09-01	Security Engineering	Encryption standards update; ISO 27001 mapping
3.0	2026-01-15	Trust Center Program	Full procurement-grade expansion; 34-document set

Contact

Acme Cloud, Inc. 1200 Market Street, Suite 400 San Francisco, CA 94103, USA

Channel	Email	Use case
Trust & procurement	trust@acmecloud.com	Security questionnaires, trust reviews
Security	security@acmecloud.com	Incidents, vulnerabilities, control questions
Privacy	privacy@acmecloud.com	DSRs, privacy assessments
Legal	legal@acmecloud.com	Contractual, DPA, legal notices

Logging Operations Contacts

Contact	Role	Use Case
security@acmecloud.com	Security Team	Alert investigation; log access requests
sre-oncall@acmecloud.com	SRE On-Call	Log infrastructure issues
logging-support@acmecloud.com	Logging Team	Log collection issues; format questions
legal@acmecloud.com	Legal	Legal hold; forensic requests

Appendix: Log Review Checklist

Review Item	Frequency	Owner	Documentation
Critical alert review	Daily	Security on-call	Alert notes
High alert review	Daily	Security team	Alert notes
Authentication anomaly review	Daily	Security team	Review log
Privileged activity review	Weekly	Security team	Review log
Failed login trend analysis	Weekly	Security team	Trend report
Data access pattern review	Weekly	Security team	Pattern report
Rule effectiveness analysis	Monthly	Security lead	Tuning report
Retention compliance check	Quarterly	Compliance	Audit report
Log coverage assessment	Annually	Security + Engineering	Gap analysis

Document Version: 3.0 Last Updated: January 15, 2026