ISC2 Certified Cloud Security Professional (CCSP) Practice Question

A gap in audit evidence usually occurs when no written policy assigns ownership for generating, retaining, and producing logs. The security team should therefore issue or update an organizational cloud-logging policy (or a specific "Virtual-Machine Logging" control) that explicitly designates who-provider, customer, or both-must collect, store, and protect the logs and for how long. A right-to-audit clause supports verification but does not itself assign control ownership. Deploying host-based IDS adds a technical safeguard, and a best-effort SIEM export directive lacks enforceability; neither clarifies responsibility. Updating incident-response playbooks improves procedures during an event but still relies on underlying policy to define who must actually retain the logs.