3.2.3 Based on the procedures referred to in point 3.2.1., the relevant entities shall maintain, document …

Requirement

Based on the procedures referred to in point 3.2.1., the relevant entities shall maintain, document and review logs. The relevant entities shall establish a list of assets to be subject to logging based on the results of the risk assessment carried out pursuant to point 2.1. Where appropriate, logs shall include: (a) relevant outbound and inbound network traffic; (b) creation, modification or deletion of users of the relevant entities’ network and information systems and extension of the permissions; (c) access to systems and applications; (d) authentication-related events; (e) all privileged access to systems and applications and activities performed by administrative accounts; (f) access or changes to critical configuration and backup files; (g) event logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls; (h) use of system resources, as well as their performance; (i) physical access to facilities; (j) access to and use of their network equipment and devices; (k) activation, stopping and pausing of the various logs; (l) environmental events.

Guidance

• With regard to critical configuration, consider the settings and parameters that are vital for the proper functioning, security and performance of the entity’s network and information system. These configurations are vital because any changes or misconfigurations might have a significant impact, including system outages, security vulnerabilities or reduced performance of the entity’s network and information system.
• Consult the risk assessment results to determine which network traffic needs to be logged. For example, if certain assets are identified as high risk (e.g. due to being potentially vulnerable or crucial to the business operation) their inbound and outbound traffic should be logged for monitoring and analysis.

Examples of evidence

• Samples of log files containing the elements referred to in point 3.2.3 of the Annex to the regulation.
• Samples of log files containing current and historical domain name system (DNS) and dynamic host configuration protocol (DHCP) logs.

1. Áttekintés

1.1 Hivatkozások

1.2 Azonosított követelmények

1.3 Kapcsolódó szabályozások

2. Azonosított követelmények

3. Kapcsolódó szabályozások

Kapcsolt feladatok

• ENISA -