3.2.3: Log management and review

Based on the procedures referred to in point 3.2.1, the relevant entities shall maintain, document, and review logs. The relevant entities shall establish a list of assets to be subject to logging based on the results of the risk assessment carried out pursuant to point 2.1. Where appropriate, logs shall include:

1. relevant outbound and inbound network traffic;
2. creation, modification or deletion of users of the relevant entities’ network and information systems and extension of the permissions;
3. access to systems and applications;
4. authentication-related events;
5. all privileged access to systems and applications, and activities performed by administrative accounts;
6. access or changes to critical configuration and backup files;
7. event logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls;
8. use of system resources, as well as their performance;
9. physical access to facilities;
10. access to and use of their network equipment and devices;
11. activation, stopping and pausing of the various logs;
12. environmental events.