Compliance Framework Audit Logging Requirements

Every major compliance framework requires audit logging. Understand what each framework demands and how AuditKit satisfies those requirements with SHA-256 hash chains, Merkle tree proofs, and tenant-isolated event streams.

SOC 2 Audit Logging Requirements

SOC 2 requires organizations to maintain comprehensive audit logs that track user activity, system changes, and security events across all trust services criteria.

Retention: Minimum 1 year (SOC 2 Type II audit window is typically 3-12 months)5 logging requirements

ISO 27001 Audit Logging Requirements

ISO 27001 mandates audit logging as part of Annex A controls for information security event logging, protection of log information, and administrator activity logging.

Retention: Organization-defined, typically 1-3 years (must align with risk assessment)4 logging requirements

HIPAA Audit Logging Requirements

HIPAA requires covered entities and business associates to implement audit controls that record and examine activity in systems containing electronic protected health information (ePHI).

Retention: 6 years from creation date or last effective date (per 45 CFR 164.530(j))4 logging requirements

GDPR Audit Logging Requirements

GDPR requires organizations to demonstrate accountability through records of processing activities and maintain audit trails for data access, consent changes, and data subject requests.

Retention: Data minimization principle applies - retain logs only as long as necessary for the stated purpose4 logging requirements

FedRAMP Audit Logging Requirements

FedRAMP requires cloud service providers to implement extensive audit logging based on NIST SP 800-53 controls, including AU-2 through AU-12 for event logging, analysis, and protection.

Retention: Minimum 1 year online, 3 years total (per NIST SP 800-53 AU-11)5 logging requirements

CMMC Audit Logging Requirements

CMMC requires defense contractors to implement audit logging controls derived from NIST SP 800-171, covering audit event creation, content, review, and protection.

Retention: Per NIST SP 800-171: organization-defined, typically 1-3 years4 logging requirements

DORA Audit Logging Requirements

DORA requires EU financial entities and their ICT service providers to implement comprehensive logging for ICT-related incidents, change management, and access control.

Retention: 5 years minimum for ICT-related incident records (Article 10)4 logging requirements

NIS2 Audit Logging Requirements

NIS2 requires essential and important entities across the EU to implement cybersecurity risk management measures including audit logging, incident reporting, and supply chain security monitoring.

Retention: Not explicitly defined; must align with national implementation and risk assessment4 logging requirements

SOX Audit Logging Requirements

SOX requires publicly traded companies to maintain audit trails for financial reporting systems, including logging of access to financial data, changes to financial records, and internal controls over financial reporting.

Retention: 7 years minimum for audit workpapers (Section 802); financial records typically 7 years4 logging requirements

PCI DSS Audit Logging Requirements

PCI DSS v4.0 Requirement 10 mandates logging of all access to cardholder data environments, protection of audit trails from tampering, and regular log review and analysis.

Retention: Minimum 12 months, with 3 months immediately available (Requirement 10.7)4 logging requirements

EU AI Act Audit Logging Requirements

The EU AI Act requires providers of high-risk AI systems to implement automatic logging of events relevant to identifying risks, monitoring operations, and ensuring traceability throughout the AI lifecycle.

Retention: Logs must be kept for a period appropriate to the intended purpose of the high-risk AI system, at least 6 months (Article 12(2))4 logging requirements

Related resources

Ready to get started?

Get SOC 2 ready with tamper-proof evidence from $99/mo. No sales call required.