10.2.1.6Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events

Defined Approach Requirements:

Audit logs capture the following:

- All initialization of new audit logs, and

- All starting, stopping, or pausing of the existing audit logs.

Defined Approach Testing Procedures:

10.2.1.6 Examine audit log configurations and log data to verify that all elements specified in this requirement are captured.