3.3.1
3.3.1
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
-
6.6.3.1 Organizations shall ensure an appropriate understanding of their security logging capabilities and needs and ensure a corresponding log management policy is in place.
NOTE: NIST SP 800-92, “Guide to Computer Security Log Management” describes considerations for Security Log Management and includes examples. Understanding what data is available and what is missing
is a key step in defining a good log management and incident.