ASVS 5.0 V16.1.1 requires an inventory documenting the logging performed at each layer of the stack: what events are logged, the format, where logs are stored, how they are used, who can access them and how long they are kept. It is Level 2. A single maintained table, reviewed regularly, satisfies it.
Why it matters
Incidents expose gaps in logging at the worst time. Without an inventory, nobody knows whether the load balancer logs are kept for seven days or seven months, or which team can read the database audit trail. Later requirements, such as V16.2.3, depend on this document existing.
How to implement it
Keep it in the repository as a reviewed file. One row per log source:
- source: api-gateway access log
layer: edge
events: request method, path, status, latency, client ip
format: JSON, one object per line
destination: central log store, index gateway-*
purpose: traffic analysis, abuse detection
access: platform team, security team (read only)
retention: 90 days hot, 1 year archive
- source: application security events
layer: application
events: login, logout, failed authorization, privilege change
format: JSON
destination: central log store, index app-security-*
purpose: investigation, alerting
access: security team
retention: 1 year
Cover every layer: edge, application, database, operating system, cloud control plane and CI. Add the document to the pull request checklist so a new log destination requires an update.
How to test it
Pick three log sources at random, find them in the real systems and compare destination, access list and retention to the document. Any mismatch is a finding.
Common mistakes
- Writing it once and never updating it.
- Listing only application logs.
- Omitting retention, which regulators often ask about first.
Quick check
Does a diagram count as an inventory?
Only if it also states events, format, access and retention for each source.
