Logging and monitoring audit program.
How to audit whether security-relevant events are logged completely, retained in a protected way, evaluated and followed up in good time when something stands out.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation has defined which events are logged in which systems, whether logs are protected against alteration and whether effective monitoring detects anomalies and passes them into security incident handling. It also assesses whether time sources are aligned so that events remain traceable across systems.
Scope
- Servers, databases, directory services, network components, firewalls and applications used for essential services
- Central log collection, SIEM or comparable analysis, and alerting paths
- Operation by own staff and by service providers, where they generate or evaluate logs
- Out of scope: video surveillance and logging of customer applications, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy defines which events are to be logged, how long logs are retained and who evaluates them. | ISO/IEC 27001:2022 Annex A 8.15; BSI OPS.1.1.5 | Read the policy, establish approval and currency, and compare it with the system overview. | Logging policy with approval record, system overview |
| 2 | For essential systems the events to be captured are defined, including log-ins, changes to rights, access to sensitive data and configuration changes. | ISO/IEC 27001:2022 Annex A 8.15 | Select five essential systems and compare the log sources actually enabled with the definition. | Logging concept per system, configuration extracts of logging |
| 3 | Logs are collected centrally, protected against alteration and deletion, and retained for the defined period. | ISO/IEC 27001:2022 Annex A 8.15; BSI OPS.1.1.5 | Check access rights to the log store and retrieve sample logs from within the retention period. | Authorisation extract of the log store, retention settings, retrieval examples |
| 4 | Administrators can neither change nor delete the logs of their own activity. | ISO/IEC 27001:2022 Annex A 8.15 | Check whether privileged accounts hold write or delete rights on logs and trace the separation of roles. | Role matrix, authorisation extract, log forwarding configuration |
| 5 | System clocks are synchronised with agreed time sources so that events can be matched across systems. | ISO/IEC 27001:2022 Annex A 8.17 | Read time sources and deviations on a sample of servers and network components. | Time service configuration, extract of time deviation |
| 6 | Monitoring detects anomalies in networks, systems and applications, with defined thresholds and rules for alerts. | ISO/IEC 27001:2022 Annex A 8.16; BSI DER.1; DORA Art. 10(1) and (2) | Review the monitoring rule set, compare coverage of essential systems and ask about thresholds. | Monitoring rule catalogue, coverage overview, description of thresholds |
| 7 | Alerts reach the responsible people promptly, are assessed and are tracked until resolved. | ISO/IEC 27001:2022 Annex A 8.16; DORA Art. 10(2) | Select ten alerts from the last six months and trace receipt, assessment, response time and closure. | Alert list, tickets, on-call schedule |
| 8 | Sufficiently qualified staff and hours are available for monitoring, including outside business hours. | DORA Art. 10(3); BSI DER.1 | Compare staffing, on-call model and cover arrangements with the alert volume. | Duty roster, on-call arrangement, statistics of alert volume |
| 9 | Monitoring is tested for effectiveness at regular intervals, for example with simulated events, and gaps are closed. | DORA Art. 10(1); ISO/IEC 27001:2022 Annex A 8.16 | Review test records of the last twelve months and check whether findings led to rule changes. | Test reports, rule changes, action list |
| 10 | Security-related events are passed into security incident handling and classified there. | BSI DER.1; BSI DER.2.1 | For three alerts, check whether and how they were recorded and assessed as a security incident. | Incident register, link between alert and incident |
| 11 | Logs from service providers and cloud services are available and included in the analysis. | ISO/IEC 27001:2022 Annex A 8.15 and 5.22 | For two outsourced services, check which logs are provided and whether they feed into monitoring. | Contract clauses on logs, connection of log sources |
| 12 | Data protection for logs is regulated: access, purpose limitation and deletion periods for personal content are defined. | Good practice | Review the rules on access and deletion and compare them with the works agreement or the data protection concept. | Data protection concept, deletion concept, agreement with the employee representation |
Documents to request
- Logging and monitoring policy
- System overview with logging concept per essential system
- Configuration extracts of logging and time synchronisation
- Monitoring rule catalogue and coverage overview
- Alert list of the last six months with tickets
- On-call schedule and escalation rules
- Authorisation extract of the central log store
- Test reports on monitoring
Typical findings
- Essential systems produce no logs or only local logs that are not collected centrally.
- Administrators hold write or delete rights on the logs that record their activity.
- Time sources are not aligned, so events cannot be matched across systems.
- Alerts are generated but not assessed promptly; there is no on-call cover outside business hours.
- Monitoring has never been tested; rules date from the introduction and have not been adapted.
- Logs of service providers and cloud services are not connected.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing