Log Sensitive Data Access
Description
Log sensitive data access, including modification and disposal.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
Data governance and compliance platform with DLP, information protection, sensitivity labels, and insider risk management
Microsoft · Per-user subscription (E5/standalone)
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Undetected Unauthorized Data Access
ConfidentialityWithout logging of sensitive data access, attackers or insiders read, copy, or modify sensitive records without creating any audit trail, making breaches undetectable.
Tampering with Sensitive Records Without Accountability
IntegrityUnauthorized modification or deletion of sensitive data goes unnoticed and uninvestigated because no logs capture who accessed or changed the data and when.
Vulnerabilities (When Safeguard Absent)
No Audit Trail for Sensitive Data Access
Without logging sensitive data access events, the organization cannot detect unauthorized access, investigate breaches, or demonstrate compliance with data protection regulations.
No Monitoring of Data Modification and Disposal
Without logging data modification and disposal events, the organization cannot verify data integrity, detect tampering, or confirm that disposal occurred as required.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |