Log Records

[All Actors]
1. Comprehensive AI Lifecycle Logging: Log key events from data ingestion and preprocessing through model training, validation, and inference. Capture relevant metadata (e.g., model versions, data sources, hyperparameters) and link operations to specific users or system events. Include performance metrics (accuracy, loss, latency) and model health indicators (drift detection, anomalies).

2. Automated Monitoring and Incident Management: Deploy real-time analysis and alerting on AI-related logs to detect unusual patterns (e.g., abnormal inference requests, unauthorized model changes). Define incident response procedures for escalations, involving both internal teams and external service providers as necessary.

3. Secure Log Handling and Retention: Encrypt log data at rest and in transit, applying integrity checks to prevent tampering. Use role-based access controls for log review and analysis, and define retention periods that satisfy policy and regulatory requirements.

4. Regular Configuration Reviews: Periodically update logging schemas, retention rules, and alert thresholds to address new AI features, data types, or compliance mandates. Involve stakeholders (security, compliance, engineering) in these reviews to ensure comprehensive coverage.

1. Inquiring with Control Owners

1.1 Conduct interviews with personnel responsible for generating audit records containing relevant cloud infrastructure security information to understand their processes for capturing, formatting, and maintaining security-related audit data across AI processing resources and customer workload environments. Verify their understanding of what constitutes relevant infrastructure security information and their procedures for ensuring audit records contain sufficient detail for infrastructure security investigations, customer isolation validation, and service availability requirements.

2. Inspecting Records and Documents

2.1 Verify cloud infrastructure logs capture event type, timestamp, actor, and source for all compute resource operations, customer workload activities, and infrastructure management events.

2.2 Confirm logs include identifiers for correlating infrastructure actions across compute clusters, storage systems, and customer tenant environments.

2.3 Ensure structured formats (e.g., JSON, syslog) are used for consistency across cloud infrastructure logging systems.

2.4 Check completeness of cloud infrastructure log records by sampling resource allocation trails, customer workload execution patterns, and infrastructure operation flows.

2.5 Validate that custom infrastructure events are logged where relevant (e.g., hypervisor escape attempts, customer isolation violations, resource exhaustion attacks).

2.6 Review cloud infrastructure audit logs for evidence of tampering or missing entries related to customer workloads and infrastructure operations.

2.7 Examine cloud infrastructure audit records to ensure they contain relevant security information such as resource access controls, customer workload isolation events, infrastructure configuration changes, and security boundary violations.

2.8 Validate that cloud infrastructure audit records include sufficient contextual information to support infrastructure security investigations, customer isolation verification, and service availability analysis.

2.9 Confirm that cloud infrastructure audit record generation covers all security-relevant events across compute resources, storage systems, network infrastructure, and customer tenant isolation mechanisms.

2.10 Review cloud infrastructure audit record retention and storage mechanisms to ensure infrastructure security information remains available for customer SLA compliance and regulatory requirement timeframes.

2.11 Verify cloud-native services generate logs with required fields (e.g., resource, action, user).

2.12 Confirm records support compliance with regional and industry regulations.

2.13 Validate timestamps, source IPs, and user identifiers are present in each log record.

2.14 Review consistency across services (e.g., IAM, VMs, storage).

2.15 Check integrity of audit trails by comparing against service-level events.

2.16 Confirm that all log-generating services follow centralized schema.