OPS-03 · Secure Operations
Logging and monitoring
Security-relevant events are logged, retained and reviewed, with alerts that reach a person who acts.
7frameworks fully address it
1partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC7.2
- ISO 27001FullA.8.15
- NIST CSFFullDE.CM-01
- PCI DSSFull10.2
- HIPAAFull164.312(b)
- GDPRPartialArt. 32 Implied by appropriate measures.
- EU AI ActFullArt. 12
- NIST AI RMFFullMEASURE 3.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Logging configuration, retention, alert handling records.
?Why it exists
Logs nobody reads are storage, not detection.
For a smaller organizationCloud provider logs, one alert channel, reviewed weekly.