AU-15 — Alternate Audit Logging Capability

Have a backup plan for audit logging. If your primary logging mechanism fails, you need an alternate way to capture audit events until the primary is restored.

Example 1: Configure systems to write audit logs both to the local event log and to the SIEM. If the SIEM forwarder fails, local logs continue to accumulate and can be imported later. Set local log file sizes large enough to buffer at least 48 hours of events.

Example 2: For cloud systems, enable platform-native logging (Azure Activity Logs, AWS CloudTrail) in addition to your SIEM connector. If the SIEM connector breaks, the platform logs provide continuity. Set up an alert (in Azure Monitor or CloudWatch) that detects when the SIEM connector stops receiving data.