6.6.3.1
Computer Security Log Management
Computer Security Log Management – Understanding of Security Logging Capabilities – Log Management – The organization shall have a policy on log management (including log backup), and a procedure to implement the policy.
NOTE: The retention period for logs depends on various factors, including legal requirements, business needs, and best practices.
-
5.28 Collection of Evidence: The organization should develop and enforce procedures to identify, gather, acquire, and preserve evidence pertaining to information security events.
6.8 Information Security Event Reporting: The organization should provide personnel a way to report observed or suspected information security events promptly through suitable channels.
8.15 Logging: Generate, store, protect, and analyze logs that record activities, exceptions, faults, and other relevant events.
-
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
3.10.4 Maintain audit logs of physical access.
-
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
3.10.4 Maintain audit logs of physical access.