What are auditable logs and why are they important in security?

• A. Records of security events used for compliance.
• B. Logs of non-security events.
• C. Records of security events used for accountability, investigation, and trend analysis.
• D. Only information about password changes.

Answer: (C)

Auditable logs are records of security-related events that allow you to trace what happened in a system. They capture details like who performed an action, what was done, when it happened, where it occurred, and the outcome. This makes them valuable for accountability (knowing who did what and when), for investigations (recreating incidents and understanding the sequence of events), and for trend analysis (spotting patterns such as repeated failed logins or unusual access times).

They’re important in security because they provide evidence for audits, help detect and respond to incidents, and support continuous improvement by revealing patterns and potential policy violations. The best description among the options is the one that emphasizes records of security events used for accountability, investigation, and trend analysis, since it covers the full range of their purpose. The other descriptions are too narrow: logs of non-security events omit security relevance, focusing only on password changes misses the broader range of security activity, and emphasizing compliance alone doesn’t address investigation and analysis needs.