Logging and Audit Controls Evidence for MSPs

MSPs that operate systems containing electronic protected health information or that support clients pursuing SOC 2 must record and examine system activity, then retain the records in a form that OCR investigators, SOC 2 auditors, and cyber-insurance underwriters can review. The difference between a clean response and a finding is usually whether the logs exist, whether someone looked at them, and whether the package can be produced under the MSP’s own brand.

Logging sits at the intersection of three conversations MSPs already have with clients: HIPAA technical safeguards, SOC 2 system operations, and the questions that appear on insurance applications after a ransomware claim. The same Microsoft 365 sign-in logs, EHR audit trails, and endpoint detection events feed all three when they are collected, protected, and reviewed on a schedule.

TLDR: Implement centralized logging for every system that touches ePHI or in-scope SOC 2 data, retain the records long enough to cover both the six-year HIPAA documentation window and a SOC 2 Type II observation period, document a review cadence, and package the resulting evidence so one set of exports answers OCR, auditors, and underwriters.

What 45 CFR 164.312(b) Actually Requires

The Audit Controls standard at 45 CFR 164.312(b) is required, not addressable. It states that a covered entity or business associate must implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information (eCFR, 45 CFR 164.312).

Two verbs matter: record and examine. Turning logging on satisfies only the first. OCR investigators look for evidence that someone reviewed the logs on a defined schedule and escalated suspicious activity. Unreviewed logs are a common finding.

The regulation does not list required fields or a mandatory retention period for the raw log data itself. Organizations document a risk-based approach. In practice, reviewers expect entries that show who performed an action, what the action was, which system or record was affected, and when it occurred. Related documentation—the logging policy, the review procedure, and records of the reviews themselves—must be retained for six years under 45 CFR 164.316(b)(2)(i).

When the MSP is a business associate, the obligation applies to the systems it manages for the covered-entity client. Shared “front desk” accounts or generic service accounts that cannot be attributed fail the unique-user requirement in the access-control standard and simultaneously make the audit trail useless.

Mapping the Same Logs to SOC 2 CC7 and Cyber Insurance

SOC 2 Trust Services Criteria do not name a specific SIEM product. CC7.2 (monitoring for anomalies) and the surrounding system-operations criteria expect the entity to collect relevant logs, detect deviations, evaluate events, and respond. Auditors sample across the Type II observation period—commonly six to twelve months—so retention must cover that window plus a buffer.

The identical Microsoft Entra ID sign-in and audit logs that demonstrate HIPAA unique-user identification and authentication also satisfy the access-monitoring points of focus under CC6 and CC7. Endpoint detection and response alerts, firewall logs, and cloud-platform audit trails supply the anomaly detection evidence. MSPs that already produce the HIPAA evidence package can reuse the same exports for SOC 2, provided the systems in scope are documented and the review cadence is followed for the full observation period. For a broader checklist of SOC 2 controls MSPs commonly package, see the SOC 2 Compliance Checklist for MSPs (2026 Edition).

Cyber-insurance underwriters ask parallel questions. Applications frequently request proof that logging is enabled, that privileged activity is recorded, that logs are retained, and that someone reviews alerts. The same Conditional Access and sign-in log exports that support the HIPAA authentication standard answer those questions. Linking the two conversations shortens renewals and reduces the chance that an underwriter finding later appears in an OCR inquiry. The MSP’s Guide to Getting Clients Cyber Insurance Approved in 2026 walks through the control mappings that most carriers request.

What CISA and the 2026 DBIR Tell MSPs About Logging

CISA’s guidance for MSPs explicitly calls for preserving, aggregating, and correlating log information to maximize detection, and for integrating MSP and customer log files into monitoring systems (CISA Insights: Guidance for MSPs and Small and Mid-sized Businesses). More recent joint guidance on event logging recommends a baseline of authentication, privilege, system, and network events with sufficient retention and protection against tampering (CISA Best Practices for Event Logging and Threat Detection).

The 2026 Verizon Data Breach Investigations Report analyzed more than 22,000 confirmed breaches. Ransomware appeared in 48 percent of breaches, and third-party involvement reached 48 percent (Verizon DBIR 2026). MSPs sit in the middle of both statistics: they are the third party for many clients, and their tools are frequent initial-access or lateral-movement vectors. Centralized logs that capture MSP remote-access activity, RMM job history, and privileged Entra ID changes give both the MSP and the client an independent record when an incident occurs.

Building the Evidence Package MSPs Can Deliver

A usable package for an MSP client typically contains four artifacts that can be regenerated under the MSP’s own brand.

First, the written logging and monitoring policy that names the systems in scope, the events that must be captured, the retention period, and the review cadence. Second, configuration evidence—screenshots or exports—showing that diagnostic settings, audit policies, and forwarding rules are enabled on the identity provider, EHR, endpoints, and any cloud platforms that store ePHI. Third, a sample of recent log entries (with ePHI redacted) that demonstrate the required fields are present. Fourth, the review records themselves: the date of each review, who performed it, what was examined, and the disposition of any alerts.

These items also support CJIS Security Policy areas that require audit logging for systems handling criminal justice information. MSPs serving law-enforcement or court clients can reuse the same collection for the CJIS Compliance Guide for MSPs.

Retention, Integrity, and Review Cadence That Survive Scrutiny

HIPAA documentation retention is six years; SOC 2 Type II evidence must span the observation period. Most MSPs set a single retention target of at least thirteen months of hot storage plus longer-term archive for the HIPAA documentation window. Logs must be protected from modification—restricted access, immutable storage where feasible, and time synchronization via NTP so events from different systems correlate.

The review cadence is risk-based. A practical pattern used by MSPs is daily or near-real-time alerting on high-signal events (multiple failed authentications, privilege escalation, bulk EHR exports, unusual remote-access) plus a documented monthly review of a sample of the remaining logs. The review record is what OCR and auditors sample; the alerts alone are not sufficient.

How MSPs Package Logging as Recurring Compliance Work

Logging is not a one-time project. Systems change, new SaaS tools appear, and retention policies drift. MSPs that treat log collection, integrity checks, and review evidence as a recurring deliverable can charge for the ongoing work while reducing the scramble that occurs when an insurance application or OCR inquiry arrives.

Nuronus collects evidence from Microsoft 365, Google Workspace, RMM tools, and major cloud platforms into a multi-tenant dashboard, maps the controls across the eleven supported frameworks, and generates white-label reports. The same assessment that tracks HIPAA audit controls also tracks the SOC 2 monitoring criteria and the cyber-insurance questions. Start with the free plan for two clients—no credit card required—and see how the evidence package looks under your own brand. Open a free account or review pricing for larger portfolios. For healthcare-specific packaging, the HIPAA Compliance for MSPs page shows how the platform handles the technical safeguards alongside the administrative ones.

Primary sources: 45 CFR 164.312 Technical safeguards; CISA Best Practices for Event Logging and Threat Detection; Verizon 2026 Data Breach Investigations Report; CISA Insights: Guidance for MSPs.