Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.03.06Audit record reduction and report generationITSP.10.171Audit and accountability

Official Requirement

A. Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents B. Preserve the original content and time ordering of audit records

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

Your SIEM or log management platform must support filtering, searching, and reporting on audit data without altering the original records. Analysts need to be able to query logs on demand for investigations and generate reports that preserve the original content and chronological order of events.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Audit record reduction and reporting capability

Implementation steps

  1. Deploy a SIEM with full-text search, filtering, and report generation capabilities across all aggregated log sources
  2. Create and maintain report templates for standard audit review scenarios and on-demand investigation queries
  3. Verify that report outputs maintain original log content fidelity and chronological ordering
  4. Train security analysts on using the SIEM search and reporting capabilities for incident investigations

Tools / systems

Evidence artifacts

Evidence frequency: Continuous capability; quarterly report template review