+DER.1.A11 Use of a Central Logging Infrastructure to Evaluate Security-Relevant Events [Process Owner] (S)

DER.1.A11 Use of a Central Logging Infrastructure to Evaluate Security-Relevant Events [Process Owner] (S)

Event messages that are generated by IT systems and applications and stored on a central logging infrastructure (see OPS.1.1.5 Logging) SHOULD be retrievable using a tool. The selected tool SHOULD be able to analyse the messages. The collected event messages SHOULD be checked for anomalies at regular intervals. The signatures of the detection systems used SHOULD always be identically up to date so that security-relevant events can also be detected retrospectively.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
blocks G 0.29 Violations of Laws or Regulations
blocks G 0.39 Malware