CIS Control 8 asks you to collect, alert, review and retain audit logs of events that could help detect, understand or recover from an attack. Evidence needs a list of log sources, retention settings, alert rules and dated review records. Collection without review shows only half of the control.
Four verbs
CIS describes Control 8, "Audit Log Management", as collecting, alerting, reviewing and retaining audit logs of events that could help detect, understand or recover from an attack. Each verb needs its own proof.
| Verb | Proof |
|---|---|
| Collect | Inventory of log sources with settings showing logging is on |
| Alert | Rules for events that matter, with routing |
| Review | Dated review notes or tickets from alerts |
| Retain | Retention configuration and a statement of period |
Log sources worth listing for engineering
Source host audit events such as permission changes and repository deletions. CI system events such as pipeline edits and secret access. Registry events such as publishes and deletes. Cloud control plane logs. Identity provider sign in logs. Application logs for security relevant actions.
For each, record where logs go, who can read them and who can delete them. Protecting logs from tampering supports their value as evidence. Write down the retention period you chose and why.
Steps to show the cycle
- List sources and confirm each is enabled. Keep a dated export of the settings.
- Send logs to a central store with restricted write access.
- Define a short list of alertable events, such as new admin grants, disabled branch protection, new deploy keys and publishes from unknown identities.
- Route alerts to a named owner or rota.
- Sample a few alerts each quarter, trace each to a ticket and keep the trace.
- Set retention in line with your policy and any contract duties, and record it.
Which events matter most is a judgment about your risks, so write the reasoning next to the list.
What not to claim
Having logs does not show you detect attacks. Say what you collect and what you review, and be clear about gaps, such as logs you cannot yet obtain from a particular tool. Clear boundaries read as competence.
Try it yourself
Open the continuous monitoring demo and watch events raise findings. That connection between an event and a follow up record is what the alert and review verbs describe.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers compliance and evidence automation alongside SBOM and dependency scanning, which can help you collect dated records in one place. You can try the free scan at gold.safeguard.sh/scan. The decision on whether evidence is sufficient stays with your assessor.
Quick check
How long should logs be kept?
The control overview does not set a period. Choose one using your risk, policy and contractual needs, and show the setting.
Who should be able to delete logs?
Keep that group small and separate from the people whose actions are logged, then record the access list.
Sources
- CIS Control 8: Audit Log Management, Center for Internet Security
- CIS Controls list, Center for Internet Security
- CIS Controls v8.1, Center for Internet Security
Last reviewed: 19 October 2026.
