ISO 27001:2022 Annex A 8.15 – Logging Explained

If you can’t see what’s happening, you can’t protect it.
Logging is how organisations gain visibility, evidence, and control.

‍Annex A 8.15 exists to ensure organisations log, protect, and review relevant events, enabling detection of security incidents, supporting investigations, and providing accountability across systems and users.

This control is about observability, not just record keeping.

Quick Guide: Annex A 8.15 at a Glance

Annex A 8.15 of ISO 27001:2022 focuses on logging of security-relevant events.

At a practical level, this means:

Recording key system, user, and application events
Ensuring logs are accurate, complete, and protected
Preventing unauthorised deletion or modification of logs
Reviewing and analysing logs for suspicious activity
Supporting investigations, audits, and incident response

The control does not require logging everything. It expects organisations to log what matters, protect it properly, and use it effectively.

In-Depth Guide to Annex A 8.15

What Is Annex A 8.15 and Why Does It Matter?

Logs provide:

Evidence of what happened
Insight into how systems are used
Early warning of security incidents
Support for forensic investigation
Accountability for user and system actions

Without effective logging:

Incidents go undetected
Investigations rely on guesswork
Accountability is weakened
Assurance becomes difficult to demonstrate

Annex A 8.15 ensures organisations treat logs as a security control, not just a technical by-product.

This control consolidates and replaces ISO 27001:2013 controls 12.4.1, 12.4.2, and 12.4.3.

How to Implement Annex A 8.15 Effectively

A pragmatic approach to Annex A 8.15 typically includes the following elements.

1. Define What Should Be Logged

Organisations should identify events that are relevant to information security risk.

ISO 27001:2022 highlights logging of events such as:

Successful and failed access attempts
Access to data and system resources
Use of privileged accounts
Configuration and system changes
Activation or deactivation of security controls
File access, deletion, or movement
Identity and access management activities

Logging every event is rarely practical.
Logging the right events is essential.

2. Ensure Logs Contain Meaningful Information

For logs to be useful, they should typically include:

User or system identity
Description of the event
Date and time of occurrence
System or asset involved
Network or location details where relevant

Incomplete logs limit investigation and assurance value.

3. Synchronise Time Sources

Annex A 8.15 relies on accurate timelines.

Organisations should ensure:

Systems use consistent time sources
Time discrepancies are minimised and understood
Logs from different systems can be correlated

Unsynchronised logs undermine incident reconstruction.

4. Protect Logs From Unauthorised Access and Change

Logs are high-value targets.

Organisations should ensure:

Users cannot alter or delete their own logs
Logs are protected against unauthorised modification
Storage capacity prevents overwriting or loss

Protection techniques may include:

Read-only or append-only logging
Cryptographic hashing
Secure centralised log storage

If logs can be changed, they cannot be trusted.

5. Prevent Log Loss or Overwriting

Failure to generate logs is itself a risk.

Organisations should:

Monitor log generation and storage
Prevent silent log failure
Ensure sufficient storage capacity

Missing logs often indicate deeper control failure.

6. Address Privacy and Data Protection

Logs may contain personal data.

Where logs are shared internally or externally, organisations should consider:

De-identification or masking of personal data
Alignment with privacy obligations and legislation
Limiting log access to authorised personnel only

Logging should support security without creating unnecessary privacy risk.

7. Analyse Logs for Security-Relevant Activity

Logging without review provides limited value.

Organisations should ensure:

Logs are reviewed in line with defined procedures
High-risk or critical systems receive greater scrutiny
Anomalous or suspicious patterns are investigated

Analysis may be manual or supported by tooling, depending on scale and risk.

8. Monitor Logs Actively Where Risk Justifies It

Annex A 8.15 supports active monitoring, particularly for:

Privileged access
Critical systems
External-facing services

Monitoring helps detect:

Unauthorised access attempts
Lateral movement
Malicious activity
Policy violations

Detection delayed is detection diminished.

9. Define Responsibility for Logging and Review

Clear ownership is essential.

Organisations should define:

Who is responsible for log configuration
Who reviews logs
Who responds to alerts or findings

Unowned logs are rarely reviewed effectively.

10. Use Centralised Logging Where Appropriate

In complex environments, organisations may consider:

Centralised log collection
Correlation across systems
Use of specialist log management or SIEM tools

Centralisation improves visibility, correlation, and response capability.

11. Include Cloud and Third-Party Logs

Where cloud or managed services are used:

Logging responsibility is shared
Contractual clarity is essential
Relevant logs should be accessible to the organisation

Cloud does not remove logging responsibility.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Practical Considerations

Annex A 8.15 does not require:

Logging every possible event
Continuous human review of all logs
Expensive tooling by default

It does require organisations to:

Decide what is important to log
Protect logs as security evidence
Use logs to support detection and investigation

Logs only add value when they are used.

Common Challenges and How to Overcome Them

Too many logs, no insight
Focus on security-relevant events

Logs stored but never reviewed
Define review and monitoring expectations

Logs that can be altered or deleted
Apply integrity and access controls

Inconsistent timestamps across systems
Synchronise time sources

Logging failures are often discovered during incidents — not before.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Final Recommendations

Annex A 8.15 is about knowing what is happening in your environment.

When logging is implemented effectively:

Security incidents are detected earlier
Investigations are faster and more accurate
Accountability is strengthened
Assurance becomes evidence-based

You cannot protect what you cannot see.
Annex A 8.15 ensures organisations turn activity into visibility — and visibility into control.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

ISO 27001:2022 Annex A 8.15 – Logging Explained

Quick Guide: Annex A 8.15 at a Glance

In-Depth Guide to Annex A 8.15

What Is Annex A 8.15 and Why Does It Matter?

How to Implement Annex A 8.15 Effectively

1. Define What Should Be Logged

2. Ensure Logs Contain Meaningful Information

3. Synchronise Time Sources

4. Protect Logs From Unauthorised Access and Change

5. Prevent Log Loss or Overwriting

6. Address Privacy and Data Protection

7. Analyse Logs for Security-Relevant Activity

8. Monitor Logs Actively Where Risk Justifies It

9. Define Responsibility for Logging and Review

10. Use Centralised Logging Where Appropriate

11. Include Cloud and Third-Party Logs

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Practical Considerations

Common Challenges and How to Overcome Them

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Final Recommendations

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

The Annex Control Table

ISO 27001:2022 Organisational Controls

ISO 27001:2022 People Controls

ISO 27001:2022 Physical Controls

ISO 27001:2022 Technological Controls

Solutions

Quick Links

Follow Us On:

Solutions

Quick Links

Follow Us On:

Unsure where to start, lets talk!