3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on …

Requirement

The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact.

Guidance

• Identify one or more objectives of monitoring and logging (indicative, non-exhaustive list):
  • threat detection,
  • compliance assurance,
  • incident response support,
  • performance optimisation,
  • anomaly detection,
  • monitor for new vulnerability reports issued for any free and open source software components (21) used by the entity,
  • data loss prevention,
  • forensic investigations support and
  • network health monitoring.
• Procedures should describe (indicative, non-exhaustive list):
  • objectives,
  • data for collection and relevant tools,
  • description of data algorithms and
  • mechanisms for notifying the relevant personnel.
• Select tools that serve the objectives of monitoring and logging according to specific criteria (indicative, non-exhaustive list):
  • ease of use,
  • integration with the existing network and information system, including cross-border operations and the associated regulatory, security and performance considerations,
  • minimisation of manual intervention,
  • capability of collecting data from various sources, for example networks, systems and applications,
  • security features offered, for example encryption and access control and
  • costs and licencing.

Examples of evidence

• Procedures in place.
• Tools in place.
• Configuration settings of the logging function that serve the identified objectives.
• Configuration settings of the logging function in line with documented standards and/or good practices.
• Safeguards to protect the confidentiality, integrity and availability of logs.

1. Ülevaade

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

3. Seotud regulatsioonid

Lingitud teemad

• ENISA -