An IS auditor is reviewing the operational log management programme of a payments processor. Which characteristic of log records is MOST important for them to be useful as audit evidence in an investigation?
- AThe logs are written in a human readable text format so that responders can open them in any editor without specialist tooling.
- BThe logs are sampled monthly by the security team and the sampled records are summarised in a management dashboard for the chief information security officer.
- CThe logs are protected against unauthorised modification and supported by demonstrable controls over their creation, transmission and retention. Correct
- DThe logs are stored on the same server that generates the events so that timing differences between systems do not distort the recorded sequence.
Why A is wrong: Human readability is convenient for responders but does not by itself preserve evidential value, because plain text files can be modified silently after the fact.
Why B is wrong: Sampling and dashboards aid monitoring but the surviving records are still only as reliable as their source, so sampling alone does not raise evidential quality.
Why C is correct: Integrity over the full lifecycle is what allows a log to be relied upon as audit evidence, because the auditor must show the record reflects the original event.
Why D is wrong: Local storage actually weakens reliability because a compromised host can rewrite its own logs, which is why central, write protected collection is preferred.