Content library
ISO 27001 (2013): Full
12.4.1: Event logging

Requirement description

How to fill the requirement

ISO 27001 (2013): Full

12.4.1: Event logging

Task name
Priority
Status
Theme
Policy
Other requirements
Documentation of system logs for self-maintained data systems
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Security systems and logging
30
requirements

Examples of other requirements this task affects

Članak 30.1.b (logs): Postupanje s incidentima, uključujući njihovo praćenje, evidentiranje i prijavljivanje
NIS2 Croatia
9.9a §: Poikkeamien havainnointi
Kyberturvallisuuslaki
5.2.4: Log management and analysis
TISAX
30 § 3.2° (détection et journaux): La gestion des incidents
NIS2 Belgium
PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
CyberFundamentals
See all related requirements and other information from tasks own page.
Go to >
Documentation of system logs for self-maintained data systems
1. Task description

The development of system logs must keep pace with the development of the system and enable, for example, the necessary resolution of incidents. In connection with the data system list, we describe for which systems we are responsible for the implementation of the logging. For these systems, we document:

  • which data is saved on the log
  • how long log data is retained
Network usage log and process for detecting inappropriate network traffic
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Network security
26
requirements

Examples of other requirements this task affects

I11: Poikkeamien havainnointikyky ja toipuminen
Katakri
12.4.1: Event logging
ISO 27001
13.1.1: Network controls
ISO 27001
PR.AC-3: Remote access management
NIST
PR.AC-5: Network integrity
NIST
See all related requirements and other information from tasks own page.
Go to >
Network usage log and process for detecting inappropriate network traffic
1. Task description

An appropriate log is generated from the use of the network to enable the detection of actions relevant to cyber security.

The normal state of network traffic (traffic volumes, protocols, and connections) is known. In order to detect anomalies, there is a procedure for detecting events that are different from the normal state of network traffic (for example, anomalous connections or their attempts).

Deployment and regular analysis of security system logs
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Security systems and logging
26
requirements

Examples of other requirements this task affects

9.1.2: Access to networks and network services
ISO 27001
12.4.1: Event logging
ISO 27001
PR.PT-1: Audit/log records
NIST
RS.AN-1: Notifications from detection systems
NIST
8.15: Logging
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Deployment and regular analysis of security system logs
1. Task description

Security systems (e.g. firewall, malware protection) often have the ability to record a log of events. At regular intervals, make sure that a comprehensive log is accumulated and try to identify suspicious activity. The log is also useful in investigating disturbances or violations.

Definition and monitoring of alarm policies
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Security systems and logging
28
requirements

Examples of other requirements this task affects

Članak 30.1.b (logs): Postupanje s incidentima, uključujući njihovo praćenje, evidentiranje i prijavljivanje
NIS2 Croatia
9.9a §: Poikkeamien havainnointi
Kyberturvallisuuslaki
30 § 3.2° (détection et journaux): La gestion des incidents
NIS2 Belgium
3.3.6: Establish a procedure for escalating alerts
NSM ICT-SP
PR.DS-4: Adequate capacity to ensure availability is maintained.
CyberFundamentals
See all related requirements and other information from tasks own page.
Go to >
Definition and monitoring of alarm policies
1. Task description

Often, security tools provide a way to set alert policies when something potentially dangerous happens in an organization's environment. For example, Microsoft 365 has built-in alert policies to alert you to abuse of administrator privileges, malware, potential internal and external risks, and data security risks.

The organization must identify security-related events in data systems and the environments in which they operate. To respond to changes related to these events, alarm policies must be created.

Alarm policies need to be actively monitored and modified based on experience.

Data system log review
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Security systems and logging
33
requirements

Examples of other requirements this task affects

Članak 30.1.b (logs): Postupanje s incidentima, uključujući njihovo praćenje, evidentiranje i prijavljivanje
NIS2 Croatia
9.9a §: Poikkeamien havainnointi
Kyberturvallisuuslaki
5.2.4: Log management and analysis
TISAX
30 § 3.2° (détection et journaux): La gestion des incidents
NIS2 Belgium
4.2.1: Review log data and collect relevant data on the incident to create a good basis for making decisions
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Data system log review
1. Task description

The organization must be aware of the logs that accrue from the use of different data systems, whether generating the logs is the responsibility of the organization or the system provider. Logs record user actions as well as anomalies, errors, and security incidents.

The adequacy of log should be reviewed regularly. If necessary, log should be usable to determine the root causes for system incidents.

Automatic log data analyzation
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Security systems and logging
32
requirements

Examples of other requirements this task affects

Članak 30.1.b (logs): Postupanje s incidentima, uključujući njihovo praćenje, evidentiranje i prijavljivanje
NIS2 Croatia
9.9a §: Poikkeamien havainnointi
Kyberturvallisuuslaki
5.2.4: Log management and analysis
TISAX
30 § 3.2° (détection et journaux): La gestion des incidents
NIS2 Belgium
2.4.4: Activate firewall on all clients and servers
NSM ICT-SP
See all related requirements and other information from tasks own page.
Go to >
Automatic log data analyzation
1. Task description

System logs often contain a wealth of information, much of which is irrelevant to security monitoring. In order to identify events relevant to security monitoring, consideration should be given to automatically copying appropriate message types to another log or to using appropriate utilities or audit tools to review and resolve files.

Access management for files stored in the cloud
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Security systems and logging
3
requirements

Examples of other requirements this task affects

9.4.1: Information access restriction
ISO 27001
12.4.1: Event logging
ISO 27001
8.3: Information access restriction
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Access management for files stored in the cloud
1. Task description

By monitoring the amount of information shared in cloud services, efforts can be made to identify risks that could lead to unauthorized disclosure of information. With respect to files one may e.g. monitor:

  • Which employees share the most files in the cloud services?
  • How often DLP policies have issued alerts?
  • How often the warnings issued by DLP policies are ignored?
  • How much important information is in other cloud services - beyond the reach of DLP control?

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.