Skip to content
PolicyForge
← All posts
By Vyrhak SATH · Founder, NAGASHIELD SECURITY5 minReviewed

How to write a logging and monitoring policy

A logging and monitoring policy defines what you log, how long you keep it, and how you detect threats. Here is what to include — with a free template.

Why logging is your detection backbone

You cannot detect, investigate or prove an incident without logs. A logging and monitoring policy defines what events are recorded, how logs are protected and retained, and how anomalies are detected and escalated — the foundation of the NIST CSF Detect function.

What to include

  1. Scope — which systems, applications and security events are logged (authentication, access changes, admin actions, failures).
  2. What to capture — enough context to investigate (who, what, when, where), without logging secrets or excessive personal data.
  3. Centralisation — ship logs to a central, tamper-resistant store.
  4. Retention — how long logs are kept, balancing investigation needs, cost and GDPR data-minimisation.
  5. Protection — access controls and integrity of the logs themselves.
  6. Monitoring and alerting — what triggers an alert and who responds.
  7. Time synchronisation — synced clocks so events correlate across systems.

Common mistakes

  • Logging everything and keeping nothing usable (no central store, no alerting).
  • Logging secrets or excessive personal data, creating a new risk.
  • Unsynchronised clocks, making correlation impossible.

Framework alignment

Maps to ISO 27001:2022 Annex A 8.15–8.17 (logging, monitoring, clock synchronisation), the SOC 2 criteria, and NIST CSF Detect (DE.CM).

Primary sources

  • ISO/IEC 27001:2022 — Annex A controls 8.15–8.17 (logging, monitoring, clock synchronisation) (iso.org/standard/27001).
  • NIST Cybersecurity Framework — Detect function, Security Continuous Monitoring (nist.gov/cyberframework).
  • ANSSI — recommandations sur la journalisation des systèmes d'information (ssi.gouv.fr).

Generate it in minutes

See a sample logging & monitoring policy or generate yours free.

Frequently asked questions

How long should security logs be retained?

There is no single legal figure, but 6 to 12 months of readily searchable logs plus longer cold storage is a common baseline. Set retention by the longest applicable driver: incident investigation needs, regulatory requirements, and contractual obligations. Document the period and enforce it automatically.

What events must be logged for ISO 27001?

Annex A 8.15 expects logs of user activities, exceptions, faults, and security events — typically authentication, privilege use, access to sensitive data, configuration changes, and administrator actions. Annex A 8.17 adds clock synchronisation so events across systems can be correlated reliably.

Why protect logs from tampering?

Logs are evidence. If an attacker or an insider can edit or delete them, you lose your ability to reconstruct an incident. Annex A 8.15 calls for protecting log information; common controls are append-only storage, restricted access, and forwarding logs to a separate system in real time.