3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect …

Requirement

The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes.

Guidance

• Make sure that the log retention period is defined in accordance with business needs, the risk assessment results and legal requirements/obligations.
• The backup logs’ maintenance period shouldn’t be shorter than the logs’ review period, referred to in point 3.2.4 of the Annex to the regulation.
• The retention period should be in line with what is referred to in point 4.2.2 (f) of the Annex to the regulation.
• Delete data when the retention period ends.
• Consider mechanisms to protect logs from unauthorised access or changes (indicative, non-exhaustive list):
  • encryption,
  • access control,
  • hashing (section 9.2) and
  • logging of all access and changes to log files.
• The access control should be in line with what is referred to in point 4.2.2 (d) of the Annex to the regulation.

Examples of evidence

• A retention period is set.
• The retention period is in line with what is referred to in point 4.2.2 (f) of the Annex to the regulation and is shorter than the logs’ review period, referred to in point 3.2.4 of the Annex to the regulation.
• Log management is in place.
• Logs do not contain data about which retention periods have expired.
• Access control mechanisms are in place.
• Access control is in line with what is referred to in point 4.2.2 (d) of the Annex to the regulation.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.