Log Sensitive Data Access

The development of system logs must keep pace with the development of the system and enable, for example, the necessary resolution of incidents. In connection with the data system list, we describe for which systems we are responsible for the implementation of the logging. For these systems, we document:

• which data is saved on the log
• how long log data is retained

The organization must log admin and security logs from used devices and services.

These logs record actions taken by system administrators and privileged users. They help monitor changes to system configurations, user access rights, and other critical settings. By keeping these logs, an organization can audit administrative activities and ensure accountability.

Security logs capture events related to the security of systems and data. This includes login attempts, firewall activities, intrusion detection system alerts, and antivirus actions. Monitoring these logs helps identify suspicious activities that could indicate a security breach or an internal threat.

The organization must be aware of the logs that accrue from the use of different data systems, whether generating the logs is the responsibility of the organization or the system provider. Logs record user actions as well as anomalies, errors, and security incidents.

The adequacy of log should be reviewed regularly. If necessary, log should be usable to determine the root causes for system incidents.

The organization has to limit log access to authorized personnel only. Logs must log when they have been viewed and those logs have to be kept so, that log views can be identified.

The organization must have measures and operating methods for the safe storage of incoming information, information being processed and outgoing information. Storage should take into account:

• Protection of data to be stored
• Archiving of system logs
• Entire data to be stored
• Maintenance of a log of data storage procedures< /li>

All stored information must be protected against theft, modification and destruction or any other event that affects their confidentiality, integrity or availability.