Log files review
Log review leaves a record, which makes it measurable.
What the published 2016 guidance says
Log review leaves a record, which makes it measurable. The construct is the share of audit log files reviewed within the required period against all log files, as a percentage. A result below 20 percent is a signal to examine the causes of underperformance. Evidence is the review list and the record of review. Critical logs are collected daily or in real time, the rest monthly, and reporting is quarterly. The security manager owns it, security staff collect, and the management system and security leads are clients. A line chart shows the trend.
What it means in practice
Log review is a control that leaves a record. Count the logs reviewed within the defined period against the review list. The target and the threshold are secondary; the evidence of review is what an assessor will ask for.
Status of this record. For B.27, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the log review list and the evidence of review. Count the logs reviewed within the period against the list. Report the percentage and the trend. Record the action for the logs missed.
Evidence an assessor asks for
- Logging and monitoringReview log list naming the log files in scope
- Logging and monitoringEvidence of each review within the period
- Logging and monitoringQuarterly trend line with findings
The question an assessor will ask
An assessor will ask for review log list naming the log files in scope. The test for B.27 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Logs collected centrally but never reviewed by anyone
- Review list incomplete, so the percentage flatters coverage
Before the next review
Before the next review, test this against one live record: logs collected centrally but never reviewed by anyone.
What to check when the revision publishes
When DIS 27004 is published, compare the B.27 Log files review record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.