IoT hubs should have resource logs enabled

Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised. The check applies to IoT Hub.

Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised.

What this control checks

Fails and raises an alarm if the check conditions are not met

Common pitfalls

Default retention is 365 days

The requiredRetentionDays parameter has a defaultValue of 365. When retentionPolicy.enabled equals true, retentionPolicy.days must equal 0 or be greater than or equal to the required retention.

Effect can be set to Disabled

The effect parameter has a defaultValue of AuditIfNotExists. Its allowedValues are AuditIfNotExists and Disabled.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Resource logs in IoT Hub should be enabled" (383856f8-de7f-44a2-81fc-e5135b5c2aa4); PowerPipe control azure_compliance.control.iot_hub_logging_enabled.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail), AU-6(4) (Central Review and Analysis) and 1 more clause.

FedRAMP Moderate Baseline Rev 4: Mapped to AU-12 (Audit Generation).

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AU-6(4) Central Review And Analysis
AU-6(5) Central Review And Analysis
AU-12 Audit Record Generation
AU-12(1) System-Wide And Time-Correlated Audit Trial

FedRAMP Moderate Baseline Rev 4

AU-12 Audit Generation

NIST SP 800-171 Rev 2

3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions

CMMC 2.0 Level 2

AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions

FedRAMP High