Change history
As an auditor, one method that may be used to correlate processes and procedures that mitigate risk is to review activity logs. In cloud environments, these logs may be made up of separate sign-in and event logs that are capturing change history and actions performed by user accounts, service accounts, or workload identities.
In each of the cloud environments, you will find multiple options for tracking the activity that’s occurred. The amount of this activity that is tracked, where it is tracked, and for how long this information is made directly available will change based on licensing, cloud system configuration, and cloud provider. In some cases, supplementary data storage tools or platforms may need to be used to ensure longer retention that meets compliance requirements. As an IT auditor, you should also note that not all items are logged by default. In some cases, an organization may need to manually enable logging or the settings to log certain activities...
