3.2.3. Based on the procedures referred to in point 3.2.1, the relevant entities shall maintain …

(a)

relevant outbound and inbound network traffic;

(b)

creation, modification or deletion of users of the relevant entities’ network and information systems and extension of the permissions;

(c)

access to systems and applications;

(d)

authentication-related events;

(e)

all privileged access to systems and applications, and activities performed by administrative accounts;

(f)

access or changes to critical configuration and backup files;

(g)

event logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls;

(h)

use of system resources, as well as their performance;

(i)

physical access to facilities;

(j)

access to and use of their network equipment and devices;

(k)

activation, stopping and pausing of the various logs;

(l)

environmental events.