OPS-10 Logging and Monitoring - Concept
Establish written logging and monitoring policies for systems in the provider's area of responsibility that define which events could breach protection goals, how logs are activated, paused and stopped, their purpose and
4
artefacts
1
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Documented retention period per log source with the legal basis cited · SIEM / log platform
periodic reviewEvidence produced at each review
- Responsibility matrix naming owners of log configuration and of log review · SIEM / log platform
governing documentDocuments that govern the control
- Logging policy listing the event types classified as security relevant · Policy repository / GRC workspace
- Time synchronisation standard specifying the authoritative time sources · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Policy enumerates log sources yet never defines which events matter
- No rule stating who may pause or switch off logging on a system
- Retention periods in the policy inconsistent with the platform configuration
- No authoritative time source defined, so records across components cannot be correlated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-09 Data Backup and Recovery - Storage · OPS-11 Logging and Monitoring - Metadata Management Concept