Why It Matters
When a regulator asks "who accessed this data, when, and why?" — the audit trail is your answer. Without it, you cannot demonstrate compliance, investigate incidents, or defend against allegations of misconduct. Multiple regulations (GDPR, SOX, HIPAA, NIS2) either explicitly require or strongly imply the need for comprehensive audit trails.
What to Log
A complete audit trail typically records:
- Who — user identity, role, authentication method
- What — action performed (create, read, update, delete, export)
- When — timestamp (preferably UTC with timezone)
- Where — system, application, IP address, location
- What changed — before and after values for data modifications
- Outcome — success or failure of the action
Types of Audit Trails
- System audit trails — OS-level logging of logins, file access, configuration changes
- Application audit trails — business application logs (CRM, ERP, HR systems)
- Database audit trails — query logging, data modification tracking
- Network audit trails — firewall logs, access control events, traffic analysis
- Financial audit trails — transaction records, approval workflows, reconciliations
- Access audit trails — physical and logical access events
Regulatory Requirements
| Regulation | Audit Trail Requirement |
|---|---|
| GDPR | Article 30 records of processing; demonstrate compliance (accountability principle) |
| SOX | Section 802 — document retention; Section 404 — internal control documentation |
| HIPAA | Technical safeguard requiring hardware, software, and procedural mechanisms to record ePHI access |
| NIS2 | Logging and monitoring as part of required security measures |
| PCI DSS | Requirement 10 — track and monitor all access to network resources and cardholder data |
| ISO 27001 | Control A.8.15 — logging of activities, exceptions, faults, and events |
Best Practices
- Immutability — logs should be write-once; prevent tampering or deletion
- Centralized logging — aggregate logs from all systems (SIEM)
- Retention — align with regulatory requirements (typically 1–7 years depending on regulation)
- Access control — restrict who can view and manage audit logs
- Alerting — automated alerts for suspicious patterns
- Regular review — periodic analysis of logs for anomalies
- Time synchronization — use NTP to ensure consistent timestamps across systems