Audit Trail
An audit trail is the chronological, tamper-evident record of activity in a system: who did what, to which resource, when, from where. It’s the evidence layer under everything else — access reviews verify against it, incident investigations reconstruct from it, and auditors sample it to confirm your other controls actually ran.
What makes logging an audit trail
Coverage of security-relevant events (authentication, privilege changes, data access, configuration changes); attribution to a specific identity (shared accounts destroy attribution — which is half the reason they’re banned); reliable timestamps; retention matching your policy (12 months is the common floor, PCI’s explicit requirement); and integrity — logs the actor could edit are testimony, not evidence.
The questions it must answer
Every real use of an audit trail is a question under pressure: Who accessed this customer’s data last month? What changed in production before the outage? Did the departed employee’s access actually end on their last day? Design test: pick three such questions and try to answer them from your current logs in under an hour. If you can’t, you have logging, not an audit trail.
The audit and incident double-duty
Frameworks sample trails directly (SOC 2’s logging criteria, ISO’s logging controls, HIPAA’s mandated access logs for PHI). But the higher-stakes consumer is your own incident response: breach notification decisions hinge on what the trail can prove was and wasn’t accessed — and “we can’t determine scope” defaults to the expensive assumption.
Access Review — An access review is the periodic check that everyone's system access matches their role — the most-sampled SOC 2 control and the most common exception.
Continuous Monitoring — Continuous monitoring is the automated, ongoing testing of security controls — replacing point-in-time evidence scrambles with always-current audit readiness.
Incident Response Plan — An incident response plan defines how you detect, triage, contain, and learn from security incidents — with the records SOC 2 auditors and regulators sample.