Requirement
"Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed."[1]
Explanation
You must ensure that systems create and retain audit logs. The collected logs must contain enough information to identify and investigate potentially unauthorized activity. You must define an audit log retention period.
