Does a security tool's audit log help with IT general controls?
Yes, for the part of the controls that concerns the tool itself. Financial-statement auditors and ISO or SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks. 2 assessors test IT general controls: who has access to systems, how changes are approved and recorded, and how operations and incidents are monitored. A security tool's audit log provides evidence for its own slice: who has accounts, who changed detection settings or notification rules, who closed or decided on each alert, and when. On every plan, NetSenX keeps such an audit log, with retention that grows with the plan. It does not record changes in your ERP, file servers or other systems, so those need their own logs. Export the relevant extract for the audit period, and pair it with your access reviews and change tickets, so the auditor sees one consistent story.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How do we prove who changed a security setting, and when?
- How do we show an auditor which parts of our network are monitored?
- What does network detection miss if a segment is not mirrored?
- What should an incident log contain for a NIS2 audit?
- How do we show an auditor what we decided on each security alert?
Terms used here
- SOC (security operations centre)
- A team, often working around the clock, whose job is to watch for and respond to attacks.
← All 35 questions on Incident reporting deadlinesAll topics