Requirement
Cybersecurity requirements for event logs and monitoring management must be defined, documented and approved.
Control Implementation Guidelines
- Develop and document cybersecurity policy for event logs and cybersecurity monitoring management in the organization, including the following:
- Define the scope of information assets to which event logs must be activated
- Activate cybersecurity event logs on critical information assets in the organization
- Activate cybersecurity event logs of privileged access accounts on critical information assets and events of remote access in the organization
- Define technologies to collect activated cybersecurity event logs
- Continuous monitor cybersecurity event logs
- Define retention period for cybersecurity event logs (not less than 12 months)
- Support the organization's policy by the Executive Management. This must be done through the approval of the organization head or his/her deputy
Relevant Cybersecurity Tools
- Cybersecurity Event Logs and Monitoring Management Policy Template
Expected Deliverables
- Cybersecurity policy that covers the requirements of Event Logs and Monitoring Management (e.g., electronic copy or official hard copy)
- Formal approval by the head of the organization or his/her deputy on such document (e.g., via the organization's official e-mail, paper or electronic signature)
