Logging Scope

[All Actors]
1. Document a definitive list of events to log such as authentication/authorization, configuration changes, data-access, errors, admin actions, security alerts, model-lifecycle events, and third-party API calls.

2. Include essential metadata (timestamp, user/service identity, source IP, resource, action, result code, request ID) to enable correlation, investigation and audit.

3. Align the logging scope with business, regulatory and threat-detection needs; avoid collecting sensitive data unless absolutely necessary, and apply masking or tokenization when it is.

3. Maintain consistent log formats and schemas so that analytics tools, SIEM and forensic workflows can parse events across all environments.

4. Review and update the documented scope on a regular basis or whenever architecture, regulation or threat intelligence changes, and version-control the artefact.

1. Inquiring with Control Owners

1.1 Conduct interviews with personnel responsible for establishing, documenting, and implementing logging scope for cloud infrastructure events and compute resource metadata to understand their process for defining which AI processing and customer workload events should be logged and their procedures for annual reviews. Verify their understanding of infrastructure security threat environment changes that trigger scope updates and their implementation of documented logging requirements across compute clusters, storage systems, and customer tenant environments.

2. Inspecting Records and Documents

2.1 Confirm documentation specifies which cloud infrastructure events must be logged (e.g., compute resource allocation, customer workload execution, storage access, network traffic, hypervisor activities).

2.2 Validate inclusion of both success and failure events in the cloud infrastructure logging scope, including successful resource provisioning and failed authentication attempts.

2.3 Ensure regular reviews of cloud infrastructure logging scope to capture evolving infrastructure security threats such as hypervisor attacks, side-channel exploits, and customer isolation breaches.

2.4 Check scope alignment with customer SLA requirements, regulatory compliance standards, and cloud service contractual obligations.

2.5 Assess procedures for adjusting logging scope when deploying new infrastructure services, AI accelerators, or customer environments.

2.6 Confirm stakeholder approval for the defined cloud infrastructure logging scope, including input from cloud operations teams, security architects, and compliance officers.

2.7 Verify logs reflect real-world cloud infrastructure events as specified in scope documents, including resource utilization, customer activities, and system operations.

2.8 Examine evidence of annual cloud infrastructure logging scope reviews and documentation of any scope updates driven by new infrastructure threats or regulatory changes.

2.9 Review procedures for monitoring and responding to infrastructure threat environment changes that may require logging scope adjustments for emerging attack vectors.

2.10 Validate that implementation of cloud infrastructure logging scope requirements is consistently applied across all compute resources, storage systems, network infrastructure, and customer tenant isolation mechanisms.

2.11 Confirm that the scope includes all infrastructure-level logs (compute, storage, network).

2.12 Validate services automatically log user actions, configuration changes, and API calls.

2.13 Assess whether default logging scope can be customized per tenant.

2.14 Ensure regular scope reviews as services or customer requirements evolve.

2.15 Verify logging of control plane and data plane events.

2.16 Review service documentation to ensure it defines and enforces consistent logging scope.