PII Included in Audit Logs

Hello,

We have a client that is interested in including PII within their audit logs that get forwarded to a SIEM tool managed by an external service provider. The ESP has a FedRAMP-accredited environment and their SOC Team is authorized to view PII/PHI, so I'm too concerned from a compliance standpoint.

However, is it generally considered a bad practice to include PII or should be it masked? If masking/anonymizing is the path forward, can someone provide some justifications into why? …

audit cybersecurity logs pii