You're notified if audit logging fails.
What it actually means
If logging silently stops — disk full, agent down, collector offline — you've lost visibility without knowing it. You need an alert when the audit logging process fails so it gets fixed.
Pass or fail — an assessor needs a "yes" to each
- An alert fires when logging/collection fails.
- Someone is responsible for acting on it.
What to have ready
- Alerting configuration for log-pipeline health
- Sample alert or runbook
Where teams trip up
- No monitoring of the log pipeline itself
- Agents that quietly stop sending logs
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →Connected requirements
More in Audit & Accountability (3.3)
3.3.1 — Create and retain audit logs3.3.2 — Trace actions to individual users3.3.3 — Review and update what you log3.3.5 — Correlate and review your logs3.3.6 — Reduce logs and generate reports3.3.7 — Synchronize clocks for time stamps3.3.8 — Protect your logs from tampering3.3.9 — Limit who manages logging