What Belongs in an Access Ceremony Log
A field guide to the minimum entries every cold-storage access ceremony log should contain, and the common omissions auditors flag first.
12 June 2025 · 7 min read
An access ceremony log is the primary document an auditor reads when evaluating whether a cold-storage event followed your custody policy. Over four hundred ceremony reviews, we have observed the same omissions repeatedly.
The Opening Block
Every log should open with a ceremony reference number, date, start and end times (with timezone), location address, and a list of participants with roles. If a participant leaves mid-ceremony, note the departure time. Auditors treat unexplained gaps in the participant list as a red flag.
Device Inventory
Record the make, model, and serial number of each hardware wallet accessed. Note the firmware version confirmed at the start of the ceremony. If firmware was updated during the session, document the previous version, the new version, and the verification method used.
Purpose Statement
One paragraph describing why the access occurred: estate transfer, key rotation, balance verification, or policy-mandated periodic check. Vague purpose statements (“routine access”) invite follow-up questions. Be specific without revealing transaction amounts unless your policy requires it.
Step-by-Step Narrative
Chronological entries with timestamps for each significant action: device unsealing, power-on, interface navigation boundaries, signature confirmation, and re-sealing. Use plain language. Define technical terms in a glossary appendix rather than in the narrative itself.
Photographic Cross-Reference
If photographs are permitted, reference each image by annex number within the narrative (“see Photo Annex A-03”). The annex itself should label each image with timestamp, camera orientation, and subject description.
Closing Attestations
Each participant signs a statement confirming they participated in the described ceremony and that the log accurately reflects what they observed. Independent witnesses sign separately from device holders.
Common Omissions
- Firmware version not recorded at ceremony start
- No timezone on timestamps
- Participant who stepped out not noted
- Photographs taken but not cross-referenced in the narrative
- Purpose statement too vague to assess against policy
A well-constructed log does not need to be lengthy. It needs to be complete, chronological, and readable by someone who was not in the room.