10.1 Security Event Logging

Description

All security-relevant events MUST be logged with sufficient detail.

Rationale

Without logging, security incidents go undetected and uninvestigated.

Audit Procedure

1. Verify logging is enabled
2. Check log content includes required fields
3. Verify security events are captured

Remediation

1. Enable structured logging
2. Send to centralized SIEM
3. Set retention per compliance

Framework Mappings