SM-02—Secure Audit Logging

>Control Description

Organization logs critical information system activity to a secure repository. Organization disables administrators ability to delete or modify enterprise audit logs; the number of administrators with access to audit logs is limited.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that Organization's Logging Standard includes logging requirements for critical system activity to mandate log forwarding and storage in a central repository. 2. Establish a process for periodic review of appropriate access of the administrators to SIEM tool. 3.Ensure that only a defined list of users are allowed to delete/modified SIEM logs.

>Testing Procedure

1. Inspect Organization's Logging Standard to determine whether logging requirements are defined for critical system activity to mandate log forwarding and storage in a central repository. 2. Inspect the list of SIEM tool Administrators and validate that their access is appropriate. 3. Validate the list of users allowed to delete/modified SIEM tool logs and ensure it is restricted.