{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Incident Management & Response"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Alog-missing-audit-trail","description":"Absence of logging/audit trails means unauthorized activity cannot be detected, investigated, or attributed, and adversary actions (obfuscation of intrusion detection, tampering with logs) go unnoticed.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"log-missing-audit-trail","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:log-missing-audit-trail","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Alog-missing-audit-trail","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc1"],"sourceUrl":null,"title":"Missing or insufficient logging and audit trails","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:09eece294f443acd1ed951438aa338eddc1c625914950cb927fead63e22bc86c","properties":{"rationale":"Tamper-resistant forwarding, tamper alerts, and retention prevent records being deleted/altered or aging out, so trails are not lost.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-03-68ab930e.json","sourceId":"uc:UC-LOG-03","targetDetailPath":"/data/v1/records/risk-log-missing-audit-trail-37d1ba80.json","targetId":"risk:log-missing-audit-trail","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1014cf6907ee24bbe99537fc7ce927f8d8ff672bf1ce05b8a1240b8ed9fc2f7c","properties":{"rationale":"Recording investigation actions and preserving evidence integrity, provenance, and chain of custody defends against unattributable and tampered records (mustKeep).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/risk-log-missing-audit-trail-37d1ba80.json","targetId":"risk:log-missing-audit-trail","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:35e1dfb346a72fd0c22d2413ff5a7d57a2ebd258234bdaa359d941754b0c242b","properties":{"rationale":"Systems generate protected log records made available for continuous monitoring, directly remedying absent/insufficient audit trails.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-18-8ffbd456.json","sourceId":"uc:UC-ACCESS-18","targetDetailPath":"/data/v1/records/risk-log-missing-audit-trail-37d1ba80.json","targetId":"risk:log-missing-audit-trail","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5aecc557dced0b6345cd6d0f238de5c64318ab782919781828d063a18e96f870","properties":{"rationale":"Capturing complete audit content directly remedies insufficient records that cannot establish what happened, when, where, and by whom.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-02-0d3519a4.json","sourceId":"uc:UC-LOG-02","targetDetailPath":"/data/v1/records/risk-log-missing-audit-trail-37d1ba80.json","targetId":"risk:log-missing-audit-trail","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:70e5368a60517c7d1a5a902712327d0eeb1490207b7cd6b11878bae290665e84","properties":{"rationale":"Enabling audit logging across all systems for a defined security-event catalog directly eliminates absent/insufficient audit trails.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","sourceId":"uc:UC-LOG-01","targetDetailPath":"/data/v1/records/risk-log-missing-audit-trail-37d1ba80.json","targetId":"risk:log-missing-audit-trail","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fb2ac6c31a059c3019577e8cefe32d3c5da85a674664ffd768cb879005a1cdf0","properties":{"rationale":"Exchanging audit data across boundaries and preserving identity context to trace cross-organizational actions remedies audit-trail gaps at provider handoffs.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-09-54136146.json","sourceId":"uc:UC-LOG-09","targetDetailPath":"/data/v1/records/risk-log-missing-audit-trail-37d1ba80.json","targetId":"risk:log-missing-audit-trail","type":"mitigates"}],"schemaVersion":1}