10.2.6 Initialization, stopping, or pausing of the audit logs
10.2.6 Verify the following are logged:
• Initialization of audit logs
• Stopping or pausing of audit logs.
Turning the audit logs off (or pausing them) prior to performing illicit activities is a common practice for malicious users wishing to avoid detection. Initialization of audit logs could indicate that the log function was disabled by a user to hide their actions.