risk
Missing or insufficient logging and audit trails
Absence of logging/audit trails means unauthorized activity cannot be detected, investigated, or attributed, and adversary actions (obfuscation of intrusion detection, tampering with logs) go unnoticed.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Logging, Monitoring & Detection
- Incident Management & Response
- taxonomy
- iso-27005-vulnerability
- nist-800-30-threat-event
- inherent_rating
- high
Details
- risk_id
- log-missing-audit-trail
- category
- cyber_security
- likelihood
- high
- impact
- medium
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
- nist-800-30-threat-event
Source
No record-specific source URL is provided.
Connections
- UC-LOG-03 — Protect audit logs and retain them for required periods mitigates Missing or insufficient logging and audit trails
- strength
- primary
- rationale
- Tamper-resistant forwarding, tamper alerts, and retention prevent records being deleted/altered or aging out, so trails are not lost.
- UC-IR-07 — Investigate incidents and preserve evidence and records mitigates Missing or insufficient logging and audit trails
- strength
- primary
- rationale
- Recording investigation actions and preserving evidence integrity, provenance, and chain of custody defends against unattributable and tampered records (mustKeep).
- UC-ACCESS-18 — Log and monitor system activity, capacity, and incidents mitigates Missing or insufficient logging and audit trails
- strength
- primary
- rationale
- Systems generate protected log records made available for continuous monitoring, directly remedying absent/insufficient audit trails.
- UC-LOG-02 — Record complete audit content with synchronized clocks mitigates Missing or insufficient logging and audit trails
- strength
- primary
- rationale
- Capturing complete audit content directly remedies insufficient records that cannot establish what happened, when, where, and by whom.
- UC-LOG-01 — Log security-relevant events across all systems mitigates Missing or insufficient logging and audit trails
- strength
- primary
- rationale
- Enabling audit logging across all systems for a defined security-event catalog directly eliminates absent/insufficient audit trails.
- UC-LOG-09 — Monitor providers and exchange audit data across organizations mitigates Missing or insufficient logging and audit trails
- strength
- primary
- rationale
- Exchanging audit data across boundaries and preserving identity context to trace cross-organizational actions remedies audit-trail gaps at provider handoffs.