3.2.7 The procedures as well as the list of assets that are being logged shall be reviewed and, where …

Requirement

The procedures as well as the list of assets that are being logged shall be reviewed and, where appropriate, updated at regular intervals and after significant incidents.

Guidance

• Determine the frequency of reviews based on the risk assessment results related to the criticality of the assets, ensuring that reviews are conducted at least annually.
• Include the t esting of monitoring and logging procedures in security testing (section 6.5).
• Review a random sample of logs to verify that all the assets that should be subject to the log are actually considered.

Examples of evidence

• Review plans or schedules.

Tips: guidance

• In addition to the elements mentioned in point 3.2.3 of the Annex to the regulation, last login for every account should be logged.
• Document monitoring and logging procedures.
• Assess the frequency of monitoring activities to ensure they are sufficient to support risk-based security decisions for adequately protecting the entity’s network and information systems.
• Make sure that personal data that are included in the logs is not processed unnecessarily. When required, an additional level of protection is deployed after performing a data protection impact assessment.
• Determine the log baselines in line with the needs and the capabilities of the business (indicative, non-exhaustive list):
  • structured or semi-structured, if possible, instead of unstructured format;
  • consistent data format in line with the selected tools and well-known standards, for example JavaScript Object Notation and extensible markup language (XML);
  • log level in line with the classification level of the asset being logged – the entity should assign a higher log level, for example ‘error’/‘fatal’, to highly classified assets while the lower log levels, for example ‘info’/‘debug’, should be used for assets with a lower classification; and
  • the standard for the timestamps, for example ISO-8601 (26), RFC 3339 (27) or RFC 9557 (28).
• Each log entry should contain necessary metadata such as (indicative, non-exhaustive list):
  • log level;
  • timestamp;
  • source identifier, for example the application or the device relevant to the entry; and
  • a unique identifier for the entry.
• Correlate data from different sources, if applicable.
• Select tools that monitor and protect end point devices.
• Select tools that can collect and analyse network traffic in real time to detect anomalies, data exfiltration and even the most advanced threats, while offering the option of automatic remediation.

Tips: examples of evidence

• Documented procedures.
• Log baselines in place.
• Logs (samples) containing necessary metadata.
• EDR tools.
• Network detection and response (NDR) tools.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• ENISA -