Ask for logs of configuration changes, identity events such as sign ins and token creation, data access and, where relevant, network flows. They should be part of the product you buy, exportable to your systems, and kept long enough to investigate. CISA's guide suggests at least six months for hosted services at no extra charge.
Why logs belong in the purchase decision
When something goes wrong, logs decide whether you can say what happened. Without them you may not know if an account was misused or if data was read. Logs you cannot get, or that expire in days, leave you guessing.
CISA's Secure by Demand guide asks whether security logs are included in the baseline product. For cloud and software as a service providers it says they should be kept and available for at least six months at no additional charge. It lists the categories: configuration changes, identity events such as sign ins and token creation, network flows where applicable, and data access.
The list to ask for
| Category | What it answers |
|---|---|
| Authentication events | Who signed in, when, from where, and who failed |
| Token and key creation | Whether someone created a long lived credential |
| Configuration changes | Who changed a setting, and what it was before |
| Administrative actions | Who added users, changed roles or exported data |
| Data access | Who read or exported which records |
| Network flows | Where connections came from, for products that carry traffic |
Questions for the vendor
- Which of these categories are logged by default, and which need a setting?
- Is any category available only on a higher tier?
- How long are logs kept, and can we extend it?
- Can logs be exported continuously to our system, in what format and through what method?
- Are the logs tamper evident, and can an administrator delete them?
- Do logs include the identity of vendor staff who access our tenant?
- How soon after an event does it appear?
What to test
During acceptance testing, perform one action in each category and confirm it appears with a user, a time and enough detail. See our acceptance checklist. Missing fields are a finding you can raise before go-live, when the vendor is still listening.
Retention on your side
Do not rely on the vendor's retention alone. Export to your own store so the evidence survives a contract end or a vendor incident. Set your own retention based on policy and legal needs. This post does not tell you how long to keep logs for any regulation, so check the rules that apply to you.
Contract language
- Security logs in the categories listed are included in the base product.
- Logs are exportable by an API or a standard method.
- Logs are retained for a stated period and remain available after termination for a stated transition period.
- The vendor will provide logs for incident investigation within a stated time on request.
Have counsel check the wording.
Quick check
Is six months enough?
CISA's guide cites at least six months for hosted services. Your own policy and legal needs may require longer.
Should I export logs myself?
Yes. Keep your own copy so evidence outlasts the vendor relationship.
Safeguard's compliance and evidence automation helps you keep evidence of your own controls.
Sources
Last reviewed: 19 October 2026.
