Logging and Monitoring Policy (A.8.15, A.8.16)
Document ID: logging-monitoring-policy
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Annual
note
This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.
Purpose
Define what events are logged, how logs are protected, and how anomalous behaviour is detected and alerted.
Events to log
| Event category | System | Log destination |
|---|---|---|
| Authentication attempts (success + failure) | sigmashake-sso | D1 audit_events (hash-chained) + nightly R2 export. Worker observability is enabled in sigmashake-sso/wrangler.toml. No Logpush job is configured in code. |
| API key usage | Cloudflare API Gateway | Cloudflare audit log |
| Evidence collection outcomes | sigmashake-compliance | D1 evidence_runs + R2 |
| Compliance gaps opened/closed | sigmashake-compliance | D1 gaps |
| Deployment events | Cloudflare Workers | Wrangler deploy audit + deployments collector |
| Staff portal access | sigmashake-compliance | D1 audit trail |
| Webhook events (Stripe, GitHub) | sigmashake-compliance | evidence_runs |
Log retention
| Log type | Retention | Storage |
|---|---|---|
| Evidence objects | 90-day Object Lock is a target set by hand in the Cloudflare dashboard. Verification is an open ISMS-owner action. The weekly r2-object-lock-verify collector checks the bucket rules. Objects are kept indefinite in practice. | R2 EVIDENCE |
| Audit packages | At least 90 days Object Lock (checked by the r2-object-lock-verify collector). No longer period is set in code. | R2 AUDIT_PACKAGES |
| D1 evidence_runs | Indefinite (D1 is durable) | D1 |
| Cloudflare analytics | 30 days (free plan) / longer with paid | Cloudflare |
| SSO audit events | D1 rows are not pruned by code. A nightly export writes them to R2. The code and sigmashake-sso/wrangler.toml target 7-year retention for the export. The 7-year R2 Object Lock is an operator target set in the Cloudflare dashboard, not in code, and no code checks it. The D1 rows are never deleted. | D1 audit_events + R2 AUDIT_BUCKET |
Log protection
- Evidence blobs are signed (Ed25519) and stored in R2. The target is Object Lock in Compliance mode (a hand-set dashboard rule; the
r2-object-lock-verifycollector checks the rules, and verification is an open ISMS-owner action) - Daily Merkle roots make log tampering cryptographically detectable
- D1
evidence_runsis append-only by design; no DELETE or UPDATE operations on evidence rows
Monitoring
| What | How | Cadence |
|---|---|---|
| Collector staleness | cron-health opens gap if collector > 1.5× cadence | Daily |
| Anomalous SSO activity | sso-audit-sync mirrors SigmaShake SSO audit events and checks the hash chain (no anomaly detection) | Daily |
| Worker tail consumers | tail-consumer-coverage verifies log tail is active | Weekly |
| WAF rule state | waf-state verifies WAF is active and rules unchanged | Weekly |
Alerting
Discord webhook (COMPLIANCE_DISCORD_WEBHOOK) receives:
- Evidence collection errors (collector failures)
- Manifest seal failures
- Hub anchor failures
- Break-glass CIDR matches
The Worker sends no Discord alert for new gap rows in general and no signing key rotation reminder. A person must read each alert; no paging vendor exists.
Evidence
| Collector | Cadence | Control |
|---|---|---|
sso-audit-sync | Daily | A.5.16, A.8.15, A.8.16 |
cron-health | Daily | A.5.36, A.8.16 |
tail-consumer-coverage | Weekly | A.8.15, A.8.16 |
waf-state | Weekly | A.8.20, A.8.21, A.8.23 |