Control 3.3.4

★What This Means in Plain English

If your logging system stops working or a system stops sending logs, you need to be immediately notified. An attacker's first move is often to disable logging, so logging failures are themselves a critical security event.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Arctic Wolf SIEM heartbeat monitoring alerting when log sources stop sending data
• Automated email and SMS alerts to the security team when any log source goes silent for 15+ minutes
• Sophos XDR agent health monitoring detecting endpoint logging failures
• FortiGate syslog destination health checks with failover to secondary collector
• ComplianceArmor incident playbook for audit logging failure response

🔎Assessment Guidance

Assessors will verify that alerting is configured for audit logging failures, test by disabling a log source and confirming alert generation, review alert response procedures, and check that logging failure alerts are sent to appropriate personnel.

⚠Common Implementation Gaps

• No monitoring of logging system health
• SIEM not configured to detect missing log sources
• No alerts when endpoints stop sending logs
• Logging failures go unnoticed for days or weeks
• No documented response procedure for logging failures

⇄Cross-Framework Mapping