OPS-14 Logging and Monitoring - Storage of the Logging Data
Consolidate log data from every source into a central store in an unchangeable and aggregated form for authorised evaluation, delete it once its purpose expires, authenticate between logging servers and logged assets, and transmit over encryption or a dedicated management network.
Source: BSI C5 (121-criteria catalogue), OPS-14. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open BSI C5 (121-criteria catalogue) in the compliance library.
The edition of the catalogue is not stamped here; check the edition your attestation is issued against.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Immutability or write once configuration of the log repository · SIEM / log platform
- Mutual authentication configuration between logging agents and collectors · Identity provider / directory
- Integrity verification output for an archived log batch · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Architecture diagram of log forwarding paths into the central collector · Policy repository / GRC workspace
First move
Common gaps auditors find
- Logs held only on the originating host where an intruder can alter them
- Forwarding over unauthenticated plain syslog on the production network
- Central store writable by the same administrators whose actions it records
- Whole device classes such as network appliances never forwarded to the collector
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-13 Logging and Monitoring - Identification of Events · OPS-15 Logging and Monitoring - Accountability