3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect …

Requirement

The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes.

Guidance

• Make sure that the log retention period is defined in accordance with business needs, the risk assessment results and legal requirements/obligations.
• The backup logs’ maintenance period shouldn’t be shorter than the logs’ review period, referred to in point 3.2.4 of the Annex to the regulation.
• The retention period should be in line with what is referred to in point 4.2.2 (f) of the Annex to the regulation.
• Delete data when the retention period ends.
• Consider mechanisms to protect logs from unauthorised access or changes (indicative, non-exhaustive list):
  • encryption,
  • access control,
  • hashing (section 9.2) and
  • logging of all access and changes to log files.
• The access control should be in line with what is referred to in point 4.2.2 (d) of the Annex to the regulation.

Examples of evidence

• A retention period is set.
• The retention period is in line with what is referred to in point 4.2.2 (f) of the Annex to the regulation and is shorter than the logs’ review period, referred to in point 3.2.4 of the Annex to the regulation.
• Log management is in place.
• Logs do not contain data about which retention periods have expired.
• Access control mechanisms are in place.
• Access control is in line with what is referred to in point 4.2.2 (d) of the Annex to the regulation.

1. Ülevaade

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

3. Seotud regulatsioonid

Lingitud teemad

• ENISA -