compliance controls are associated with this Policy definition 'Azure Monitor should collect activity logs from all regions' (41388f1c-2db0-4c25-95b2-35d7f5ccbfa9)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| Azure_Security_Benchmark_v1.0 |
2.2 |
Azure_Security_Benchmark_v1.0_2.2 |
Azure Security Benchmark 2.2 |
Logging and Monitoring |
Configure central security log management |
Customer |
Ingest logs via Azure Monitor to aggregate security data generated by endpoint devices, network resources, and other security systems. Within Azure Monitor, use Log Analytics Workspace(s) to query and perform analytics, and use Azure Storage Accounts for long-term/archival storage.
Alternatively, you may enable and on-board data to Azure Sentinel or a third-party SIEM. How to onboard Azure Sentinel:
https://docs.microsoft.com/azure/sentinel/quickstart-onboard
How to collect platform logs and metrics with Azure Monitor:
https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings
How to collect Azure Virtual Machine internal host logs with Azure Monitor:
https://docs.microsoft.com/azure/azure-monitor/learn/quick-collect-azurevm
How to get started with Azure Monitor and third-party SIEM integration:
https://azure.microsoft.com/blog/use-azure-monitor-to-integrate-with-siem-tools/ |
n/a |
link |
4 |
| Azure_Security_Benchmark_v1.0 |
4.9 |
Azure_Security_Benchmark_v1.0_4.9 |
Azure Security Benchmark 4.9 |
Data Protection |
Log and alert on changes to critical Azure resources |
Customer |
Use Azure Monitor with the Azure Activity Log to create alerts for when changes take place to critical Azure resources.
How to create alerts for Azure Activity Log events:
https://docs.microsoft.com/azure/azure-monitor/platform/alerts-activity-log |
n/a |
link |
1 |
| Canada_Federal_PBMM_3-1-2020 |
AC_2(4) |
Canada_Federal_PBMM_3-1-2020_AC_2(4) |
Canada Federal PBMM 3-1-2020 AC 2(4) |
Account Management |
Account Management | Automated Audit Actions |
Shared |
1. The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies responsible managers.
2. Related controls: AU-2, AU-12. |
To ensure accountability and transparency within the information system. |
|
50 |
| Canada_Federal_PBMM_3-1-2020 |
CA_7 |
Canada_Federal_PBMM_3-1-2020_CA_7 |
Canada Federal PBMM 3-1-2020 CA 7 |
Continuous Monitoring |
Continuous Monitoring |
Shared |
1. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes establishment of organization-defined metrics to be monitored.
2. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes establishment of at least monthly monitoring and assessments of at least operating system scans, database, and web application scan.
3. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes ongoing security control assessments in accordance with the organizational continuous monitoring strategy.
4. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy.
5. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes correlation and analysis of security-related information generated by assessments and monitoring.
6. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes response actions to address results of the analysis of security-related information.
7. The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes reporting the security status of organization and the information system to organization-defined personnel or roles at organization-defined frequency. |
To ensure the ongoing effectiveness of security controls and maintain the security posture in alignment with organizational objectives and requirements. |
|
120 |
| Canada_Federal_PBMM_3-1-2020 |
SI_4 |
Canada_Federal_PBMM_3-1-2020_SI_4 |
Canada Federal PBMM 3-1-2020 SI 4 |
Information System Monitoring |
Information System Monitoring |
Shared |
1. The organization monitors the information system to detect:
a. Attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives; and
b. Unauthorized local, network, and remote connections;
2. The organization identifies unauthorized use of the information system through organization-defined techniques and methods.
3. The organization deploys monitoring devices: (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization.
4. The organization protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion.
5. The organization heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or Canada based on law enforcement information, intelligence information, or other credible sources of information.
6. The organization obtains legal opinion with regard to information system monitoring activities in accordance with organizational policies, directives and standards.
7. The organization provides organization-defined information system monitoring information to organization-defined personnel or roles at an organization-defined frequency. |
To enhance overall security posture.
|
|
93 |
| Canada_Federal_PBMM_3-1-2020 |
SI_4(1) |
Canada_Federal_PBMM_3-1-2020_SI_4(1) |
Canada Federal PBMM 3-1-2020 SI 4(1) |
Information System Monitoring |
Information System Monitoring | System-Wide Intrusion Detection System |
Shared |
The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system. |
To enhance overall security posture.
|
|
93 |
| Canada_Federal_PBMM_3-1-2020 |
SI_4(2) |
Canada_Federal_PBMM_3-1-2020_SI_4(2) |
Canada Federal PBMM 3-1-2020 SI 4(2) |
Information System Monitoring |
Information System Monitoring | Automated Tools for Real-Time Analysis |
Shared |
The organization employs automated tools to support near real-time analysis of events. |
To enhance overall security posture.
|
|
92 |
| CIS_Azure_1.1.0 |
5.1.4 |
CIS_Azure_1.1.0_5.1.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.4 |
5 Logging and Monitoring |
Ensure the log profile captures activity logs for all regions including global |
Shared |
The customer is responsible for implementing this recommendation. |
Configure the log profile to export activities from all Azure supported regions/locations including global. |
link |
5 |
| CIS_Controls_v8.1 |
13.11 |
CIS_Controls_v8.1_13.11 |
CIS Controls v8.1 13.11 |
Network Monitoring and Defense |
Tune security event alerting thresholds |
Shared |
Tune security event alerting thresholds monthly, or more frequently.
|
To regularly adjust and optimize security event alerting thresholds, aiming to enhance effectiveness. |
|
48 |
| CIS_Controls_v8.1 |
3.14 |
CIS_Controls_v8.1_3.14 |
CIS Controls v8.1 3.14 |
Data Protection |
Log sensitive data access |
Shared |
Log sensitive data access, including modification and disposal.
|
To enhance accountability, traceability, and security measures within the enterprise. |
|
45 |
| CIS_Controls_v8.1 |
8.1 |
CIS_Controls_v8.1_8.1 |
CIS Controls v8.1 8.1 |
Audit Log Management |
Establish and maintain an audit log management process |
Shared |
1. Establish and maintain an audit log management process that defines the enterprise’s logging requirements.
2. At a minimum, address the collection, review, and retention of audit logs for enterprise assets.
3. Review and update documentation annually, or when significant enterprise changes occur that could impact this safeguard. |
To ensure appropriate management of audit log systems. |
|
29 |
| CIS_Controls_v8.1 |
8.2 |
CIS_Controls_v8.1_8.2 |
CIS Controls v8.1 8.2 |
Audit Log Management |
Collect audit logs. |
Shared |
1. Collect audit logs.
2. Ensure that logging, per the enterprise’s audit log management process, has been enabled across enterprise assets. |
To assist in troubleshooting of system issues and ensure integrity of data systems. |
|
30 |
| CIS_Controls_v8.1 |
8.3 |
CIS_Controls_v8.1_8.3 |
CIS Controls v8.1 8.3 |
Audit Log Management |
Ensure adequate audit log storage |
Shared |
Ensure that logging destinations maintain adequate storage to comply with the enterprise’s audit log management process. |
To ensure all important and required logs can be stored for retrieval as and when required. |
|
21 |
| CIS_Controls_v8.1 |
8.5 |
CIS_Controls_v8.1_8.5 |
CIS Controls v8.1 8.5 |
Audit Log Management |
Collect detailed audit logs. |
Shared |
1. Configure detailed audit logging for enterprise assets containing sensitive data.
2. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. |
To ensure that audit logs contain all pertinent information that might be required in a forensic investigation. |
|
32 |
| CIS_Controls_v8.1 |
8.7 |
CIS_Controls_v8.1_8.7 |
CIS Controls v8.1 8.7 |
Audit Log Management |
Collect URL request audit logs |
Shared |
Collect URL request audit logs on enterprise assets, where appropriate and supported. |
To maintain an audit trail of all URL requests made.
|
|
29 |
| CIS_Controls_v8.1 |
8.8 |
CIS_Controls_v8.1_8.8 |
CIS Controls v8.1 8.8 |
Audit Log Management |
Collect command-line audit logs |
Shared |
Collect command-line audit logs. Example implementations include collecting audit logs from PowerShell, BASH, and remote administrative terminals. |
To ensure recording of the commands and arguments used by a process. |
|
29 |
| CIS_Controls_v8.1 |
8.9 |
CIS_Controls_v8.1_8.9 |
CIS Controls v8.1 8.9 |
Audit Log Management |
Centralize audit logs |
Shared |
Centralize, to the extent possible, audit log collection and retention across enterprise assets. |
To optimize and simply the process of audit log management. |
|
29 |
| CMMC_L2_v1.9.0 |
AU.L2_3.3.1 |
CMMC_L2_v1.9.0_AU.L2_3.3.1 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 AU.L2 3.3.1 |
Audit and Accountability |
System Auditing |
Shared |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. |
To enhance security and accountability measures. |
|
40 |
| CMMC_L2_v1.9.0 |
AU.L2_3.3.3 |
CMMC_L2_v1.9.0_AU.L2_3.3.3 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 AU.L2 3.3.3 |
Audit and Accountability |
Event Review |
Shared |
Review and update logged events. |
To enhance the effectiveness of security measures. |
|
33 |
| CMMC_L2_v1.9.0 |
AU.L2_3.3.5 |
CMMC_L2_v1.9.0_AU.L2_3.3.5 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 AU.L2 3.3.5 |
Audit and Accountability |
Audit Correlation |
Shared |
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. |
To enhance the organization's ability to detect and mitigate security threats effectively. |
|
8 |
| CMMC_L3 |
AU.2.041 |
CMMC_L3_AU.2.041 |
CMMC L3 AU.2.041 |
Audit and Accountability |
Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
This requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible. Organizations consider logging for traceability including results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, communications at system boundaries, configuration settings, physical access, nonlocal maintenance, use of maintenance tools, temperature and humidity, equipment delivery and removal, system component inventory, use of mobile code, and use of Voice over Internet Protocol (VoIP). |
link |
11 |
| CMMC_L3 |
AU.2.042 |
CMMC_L3_AU.2.042 |
CMMC L3 AU.2.042 |
Audit and Accountability |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance.
Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloudbased architectures.
Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred).
Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. |
link |
11 |
| CMMC_L3 |
CM.2.065 |
CMMC_L3_CM.2.065 |
CMMC L3 CM.2.065 |
Configuration Management |
Track, review, approve or disapprove, and log changes to organizational systems. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
Tracking, reviewing, approving/disapproving, and logging changes is called configuration change control. Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of changes to the systems, including system upgrades and modifications. Configuration change control includes changes to baseline configurations for components and configuration items of systems, changes to configuration settings for information technology products (e.g., operating systems, applications, firewalls, routers, and mobile devices), unscheduled and unauthorized changes, and changes to remediate vulnerabilities.
Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes to systems. For new development systems or systems undergoing major upgrades, organizations consider including representatives from development organizations on the Configuration Control Boards or Change Advisory Boards. Audit logs of changes include activities before and after changes are made to organizational systems and the activities required to implement such changes. |
link |
6 |
| CMMC_L3 |
SI.2.216 |
CMMC_L3_SI.2.216 |
CMMC L3 SI.2.216 |
System and Information Integrity |
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the system. Organizations can monitor systems, for example, by observing audit record activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. System monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms supporting critical applications, with such devices being employed at managed system interfaces. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of systems to support such objectives.
System monitoring is an integral part of continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless.
Unusual or unauthorized activities or conditions related to inbound/outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. |
link |
23 |
| CMMC_L3 |
SI.2.217 |
CMMC_L3_SI.2.217 |
CMMC L3 SI.2.217 |
System and Information Integrity |
Identify unauthorized use of organizational systems. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
System monitoring includes external and internal monitoring. System monitoring can detect unauthorized use of organizational systems. System monitoring is an integral part of continuous monitoring and incident response programs. Monitoring is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Output from system monitoring serves as input to continuous monitoring and incident response programs.
Unusual/unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. |
link |
11 |
| CSA_v4.0.12 |
LOG_07 |
CSA_v4.0.12_LOG_07 |
CSA Cloud Controls Matrix v4.0.12 LOG 07 |
Logging and Monitoring |
Logging Scope |
Shared |
n/a |
Establish, document and implement which information meta/data system
events should be logged. Review and update the scope at least annually or whenever
there is a change in the threat environment. |
|
33 |
| CSA_v4.0.12 |
LOG_08 |
CSA_v4.0.12_LOG_08 |
CSA Cloud Controls Matrix v4.0.12 LOG 08 |
Logging and Monitoring |
Log Records |
Shared |
n/a |
Generate audit records containing relevant security information. |
|
23 |
| CSA_v4.0.12 |
LOG_10 |
CSA_v4.0.12_LOG_10 |
CSA Cloud Controls Matrix v4.0.12 LOG 10 |
Logging and Monitoring |
Encryption Monitoring and Reporting |
Shared |
n/a |
Establish and maintain a monitoring and internal reporting capability
over the operations of cryptographic, encryption and key management policies,
processes, procedures, and controls. |
|
23 |
| CSA_v4.0.12 |
LOG_11 |
CSA_v4.0.12_LOG_11 |
CSA Cloud Controls Matrix v4.0.12 LOG 11 |
Logging and Monitoring |
Transaction/Activity Logging |
Shared |
n/a |
Log and monitor key lifecycle management events to enable auditing
and reporting on usage of cryptographic keys. |
|
23 |
| DORA_2022_2554 |
10.1 |
DORA_2022_2554_10.1 |
DORA 2022 2554 10.1 |
10 |
Implement Mechanisms to Detect Anomalous Activities in ICT Systems |
Shared |
n/a |
Establish mechanisms to detect anomalous activities within information and communication technology (ICT) systems, including network performance issues and ICT-related incidents. Additionally, identify potential material single points of failure to enhance overall system resilience and response capabilities. |
|
38 |
| DORA_2022_2554 |
10.2 |
DORA_2022_2554_10.2 |
DORA 2022 2554 10.2 |
10 |
Establish Multi-Layered Detection Mechanisms for ICT Incidents |
Shared |
n/a |
Implement detection mechanisms that provide multiple layers of control, defining alert thresholds and criteria to trigger information and communication technology (ICT) related incident response processes. This includes automated alert mechanisms to notify resources managing ICT-related incidents. |
|
40 |
| EU_GDPR_2016_679_Art. |
24 |
EU_GDPR_2016_679_Art._24 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 24 |
Chapter 4 - Controller and processor |
Responsibility of the controller |
Shared |
n/a |
n/a |
|
306 |
| EU_GDPR_2016_679_Art. |
25 |
EU_GDPR_2016_679_Art._25 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 25 |
Chapter 4 - Controller and processor |
Data protection by design and by default |
Shared |
n/a |
n/a |
|
306 |
| EU_GDPR_2016_679_Art. |
28 |
EU_GDPR_2016_679_Art._28 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 28 |
Chapter 4 - Controller and processor |
Processor |
Shared |
n/a |
n/a |
|
306 |
| EU_GDPR_2016_679_Art. |
32 |
EU_GDPR_2016_679_Art._32 |
EU General Data Protection Regulation (GDPR) 2016/679 Art. 32 |
Chapter 4 - Controller and processor |
Security of processing |
Shared |
n/a |
n/a |
|
306 |
| FBI_Criminal_Justice_Information_Services_v5.9.5_5 |
.4 |
FBI_Criminal_Justice_Information_Services_v5.9.5_5.4 |
404 not found |
|
|
|
n/a |
n/a |
|
40 |
| hipaa |
1120.09ab3System.9-09.ab |
hipaa-1120.09ab3System.9-09.ab |
1120.09ab3System.9-09.ab |
11 Access Control |
1120.09ab3System.9-09.ab 09.10 Monitoring |
Shared |
n/a |
Unauthorized remote connections to the information systems are monitored and reviewed at least quarterly, and appropriate action is taken if an unauthorized connection is discovered. |
|
1 |
| hipaa |
1214.09ab2System.3456-09.ab |
hipaa-1214.09ab2System.3456-09.ab |
1214.09ab2System.3456-09.ab |
12 Audit Logging & Monitoring |
1214.09ab2System.3456-09.ab 09.10 Monitoring |
Shared |
n/a |
Monitoring includes privileged operations, authorized access or unauthorized access attempts, including attempts to access deactivated accounts, and system alerts or failures. |
|
9 |
| HITRUST_CSF_v11.3 |
09.aa |
HITRUST_CSF_v11.3_09.aa |
HITRUST CSF v11.3 09.aa |
Monitoring |
Ensure information security events are monitored and recorded to detect unauthorized information processing activities in compliance with all relevant legal requirements. |
Shared |
1. Retention policies for audit logs are to be specified and the audit logs are to be retained accordingly.
2. A secure audit record is to be created each time a user accesses, creates, updates, or deletes covered and/or confidential information via the system.
3. Audit logs are to be maintained for account management activities, security policy changes, configuration changes, modification to sensitive information, read access to sensitive information, and printing of sensitive information. |
Audit logs recording user activities, exceptions, and information security events shall be produced and kept for an agreed period to assist in future investigations and access control monitoring. |
|
37 |
| HITRUST_CSF_v11.3 |
09.ab |
HITRUST_CSF_v11.3_09.ab |
HITRUST CSF v11.3 09.ab |
Monitoring |
Establish procedures for monitoring use of information processing systems and facilities to check for use and effectiveness of implemented controls. |
Shared |
1. It is to be specified how often audit logs are reviewed, how the reviews are documented, and the specific roles and responsibilities of the personnel conducting the reviews, including the professional certifications or other qualifications required.
2. All relevant legal requirements applicable to its monitoring of authorized access and unauthorized access attempts is to be complied with. |
Procedures for monitoring use of information processing systems and facilities shall be established to check for use and effectiveness of implemented controls. The results of the monitoring activities shall be reviewed regularly. |
|
109 |
| ISO_IEC_27001_2022 |
9.1 |
ISO_IEC_27001_2022_9.1 |
ISO IEC 27001 2022 9.1 |
Performance Evaluation |
Monitoring, measurement, analysis and evaluation |
Shared |
1. The organization shall determine:
a. what needs to be monitored and measured, including information security processes and controls;
b. the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results. The methods selected should produce comparable and reproducible results to be considered valid;
c. when the monitoring and measuring shall be performed;
d. who shall monitor and measure;
e. when the results from monitoring and measurement shall be analysed and evaluated;
f. who shall analyse and evaluate these results.
2. Documented information shall be available as evidence of the results. |
Specifies that the organisation must evaluate information security performance and the effectiveness of the information security management system. |
|
43 |
| ISO_IEC_27002_2022 |
8.15 |
ISO_IEC_27002_2022_8.15 |
ISO IEC 27002 2022 8.15 |
Detection Control |
Logging |
Shared |
Logs that record activities, exceptions, faults and other relevant events should be produced, stored, protected and analysed.
|
To record events, generate evidence, ensure the integrity of log information, prevent against unauthorized access, identify information security events that can lead to an information security incident and to support investigations. |
|
29 |
| ISO_IEC_27017_2015 |
12.4.1 |
ISO_IEC_27017_2015_12.4.1 |
ISO IEC 27017 2015 12.4.1 |
Operations Security |
Event Logging |
Shared |
For Cloud Service Customer:
The cloud service customer should define its requirements for event logging and verify that the cloud service meets those requirements.
For Cloud Service Provider:
The cloud service provider should provide logging capabilities to the cloud service customer. |
To record events, generate evidence, ensure the integrity of log information, prevent against unauthorized access, identify information security events that can lead to an information security incident and to support investigations. |
|
24 |
| K_ISMS_P_2018 |
2.10.1 |
K_ISMS_P_2018_2.10.1 |
K ISMS P 2018 2.10.1 |
2.10 |
Establish Procedures for Managing the Security of System Operations |
Shared |
n/a |
Establish and implement operating procedures for managing the security of system operations such as designating system administrators, updating policies, changing rulesets, monitoring events, managing policy implementations or exceptions. |
|
408 |
| K_ISMS_P_2018 |
2.10.2 |
K_ISMS_P_2018_2.10.2 |
K ISMS P 2018 2.10.2 |
2.10 |
Establish Protective Measures for Administrator Privileges and Security Configurations |
Shared |
n/a |
Establish and implement protective measures with regard to administrator privileges and security configurations to ensure that important information and personal information are not exposed as a result of unauthorized access by service type or misconfigurations. |
|
385 |
| K_ISMS_P_2018 |
2.11.3 |
K_ISMS_P_2018_2.11.3 |
K ISMS P 2018 2.11.3 |
2.11 |
Collect, Monitor, and Analyze Data and Network Traffic |
Shared |
n/a |
Collect, monitor, and analyze data and network traffic to respond to internal or external infringement attempts in a timely manner. |
|
31 |
| K_ISMS_P_2018 |
2.9.2b |
K_ISMS_P_2018_2.9.2b |
K ISMS P 2018 2.9.2b |
2.9.2b |
Monitor Information System Performance and Capacity |
Shared |
n/a |
Monitor the performance and capacity requirements of the information system on a continuous basis to ensure availability. |
|
4 |
| K_ISMS_P_2018 |
2.9.4 |
K_ISMS_P_2018_2.9.4 |
K ISMS P 2018 2.9.4 |
2.9 |
Maintain Logs and Establish Log Management Procedures |
Shared |
n/a |
Maintain log records for servers, applications, security systems, and networks. Define log types, access permissions, retention periods, and storage methods to ensure secure retention and prevent forgery, alteration, theft, and loss. |
|
45 |
| NIST_CSF_v2.0 |
DE.AE_03 |
NIST_CSF_v2.0_DE.AE_03 |
NIST CSF v2.0 DE.AE 03 |
DETECT-Adverse Event Analysis |
Information is correlated from multiple sources. |
Shared |
n/a |
To identify and analyze the cybersecurity attacks and compromises. |
|
25 |
| NIST_SP_800-171_R3_3 |
.3.1 |
NIST_SP_800-171_R3_3.3.1 |
404 not found |
|
|
|
n/a |
n/a |
|
33 |
| NIST_SP_800-171_R3_3 |
.3.5 |
NIST_SP_800-171_R3_3.3.5 |
404 not found |
|
|
|
n/a |
n/a |
|
16 |
| NIST_SP_800-53_R5.1.1 |
AU.12 |
NIST_SP_800-53_R5.1.1_AU.12 |
NIST SP 800-53 R5.1.1 AU.12 |
Audit and Accountability Control |
Audit Record Generation |
Shared |
a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components];
b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
c. Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3. |
Audit records can be generated from many different system components. The event types specified in AU-2d are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records. |
|
20 |
| NIST_SP_800-53_R5.1.1 |
AU.12.1 |
NIST_SP_800-53_R5.1.1_AU.12.1 |
NIST SP 800-53 R5.1.1 AU.12.1 |
Audit and Accountability Control |
Audit Record Generation | System-wide and Time-correlated Audit Trail |
Shared |
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail]. |
Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances. |
|
8 |
| NIST_SP_800-53_R5.1.1 |
AU.2 |
NIST_SP_800-53_R5.1.1_AU.2 |
NIST SP 800-53 R5.1.1 AU.2 |
Audit and Accountability Control |
Event Logging |
Shared |
a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types that the system is capable of logging];
b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
c. Specify the following event types for logging within the system: [Assignment: organization-defined event types (subset of the event types defined in AU-2a.) along with the frequency of (or situation requiring) logging for each identified event type];
d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
e. Review and update the event types selected for logging [Assignment: organization-defined frequency]. |
An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system.
To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage.
Event logging requirements, including the need to log specific event types, may be referenced in other controls and control enhancements. These include AC-2(4), AC-3(10), AC-6(9), AC-17(1), CM-3f, CM-5(1), IA-3(3.b), MA-4(1), MP-4(2), PE-3, PM-21, PT-7, RA-8, SC-7(9), SC-7(15), SI-3(8), SI-4(22), SI-7(8), and SI-10(1). Organizations include event types that are required by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. Audit records can be generated at various levels, including at the packet level as information traverses the network. Selecting the appropriate level of event logging is an important part of a monitoring and auditing capability and can identify the root causes of problems. When defining event types, organizations consider the logging necessary to cover related event types, such as the steps in distributed, transaction-based processes and the actions that occur in service-oriented architectures. |
|
23 |
| NZISM_v3.7 |
14.1.13.C.01. |
NZISM_v3.7_14.1.13.C.01. |
NZISM v3.7 14.1.13.C.01. |
Standard Operating Environments |
14.1.13.C.01. - maintain the confidentiality and integrity of critical system information, thereby enhancing overall cybersecurity posture. |
Shared |
n/a |
Agencies SHOULD review all software applications to determine whether they attempt to establish any unauthorised or unplanned external connections. |
|
9 |
| NZISM_v3.7 |
14.1.13.C.02. |
NZISM_v3.7_14.1.13.C.02. |
NZISM v3.7 14.1.13.C.02. |
Standard Operating Environments |
14.1.13.C.02. - maintain the confidentiality and integrity of critical system information, thereby enhancing overall cybersecurity posture. |
Shared |
n/a |
If automated outbound connection functionality is included, agencies SHOULD make a business decision to determine whether to permit or deny these connections, including an assessment of the security risks involved in doing so. |
|
9 |
| NZISM_v3.7 |
14.1.13.C.03. |
NZISM_v3.7_14.1.13.C.03. |
NZISM v3.7 14.1.13.C.03. |
Standard Operating Environments |
14.1.13.C.03. - maintain the confidentiality and integrity of critical system information, thereby enhancing overall cybersecurity posture. |
Shared |
n/a |
If automated outbound connection functionality is included, agencies SHOULD consider the implementation of Data Loss Prevention (DLP) technologies. |
|
9 |
| NZISM_v3.7 |
14.1.14.C.01. |
NZISM_v3.7_14.1.14.C.01. |
NZISM v3.7 14.1.14.C.01. |
Standard Operating Environments |
14.1.14.C.01. - maintain the confidentiality and integrity of critical system information, thereby enhancing overall cybersecurity posture. |
Shared |
n/a |
Agencies SHOULD limit information that could be disclosed outside the agency about what software, and software versions are installed on their systems. |
|
9 |
| NZISM_v3.7 |
14.1.9.C.02. |
NZISM_v3.7_14.1.9.C.02. |
NZISM v3.7 14.1.9.C.02. |
Standard Operating Environments |
14.1.9.C.02. - maintaining the integrity and reliability of servers and workstations within the agency's environment |
Shared |
n/a |
Agencies SHOULD ensure that for all servers and workstations:
1. malware detection heuristics are set to a high level;
2. malware pattern signatures are checked for updates on at least a daily basis;
3. malware pattern signatures are updated as soon as possible after vendors make them available;
4. all disks and systems are regularly scanned for malicious code; and
5. the use of End Point Agents is considered. |
|
9 |
| NZISM_v3.7 |
14.2.4.C.01. |
NZISM_v3.7_14.2.4.C.01. |
NZISM v3.7 14.2.4.C.01. |
Application Allow listing |
14.2.4.C.01. - mitigate security risks, and ensure compliance with security policies and standards. |
Shared |
n/a |
Agencies SHOULD implement application allow listing as part of the SOE for workstations, servers and any other network device. |
|
25 |
| NZISM_v3.7 |
16.6.10.C.01. |
NZISM_v3.7_16.6.10.C.01. |
NZISM v3.7 16.6.10.C.01. |
Event Logging and Auditing |
16.6.10.C.01. - enhance system security and accountability. |
Shared |
n/a |
Agencies SHOULD log the events listed in the table below for specific software components.
1. Database -
a. System user access to the database.
b. Attempted access that is denied
c. Changes to system user roles or database rights.
d. Addition of new system users, especially privileged users
e. Modifications to the data.
f. Modifications to the format or structure of the database
2. Network/operating system
a. Successful and failed attempts to logon and logoff.
b. Changes to system administrator and system user accounts.
c. Failed attempts to access data and system resources.
d. Attempts to use special privileges.
e. Use of special privileges.
f. System user or group management.
g. Changes to the security policy.
h. Service failures and restarts.
i.System startup and shutdown.
j. Changes to system configuration data.
k. Access to sensitive data and processes.
l. Data import/export operations.
3. Web application
a. System user access to the Web application.
b. Attempted access that is denied.
c. System user access to the Web documents.
d. Search engine queries initiated by system users. |
|
31 |
| NZISM_v3.7 |
16.6.10.C.02. |
NZISM_v3.7_16.6.10.C.02. |
NZISM v3.7 16.6.10.C.02. |
Event Logging and Auditing |
16.6.10.C.02. - enhance system security and accountability. |
Shared |
n/a |
Agencies SHOULD log, at minimum, the following events for all software components:
1. user login;
2. all privileged operations;
3. failed attempts to elevate privileges;
4. security related system alerts and failures;
5. system user and group additions, deletions and modification to permissions; and
6. unauthorised or failed access attempts to systems and files identified as critical to the agency. |
|
48 |
| NZISM_v3.7 |
16.6.11.C.01. |
NZISM_v3.7_16.6.11.C.01. |
NZISM v3.7 16.6.11.C.01. |
Event Logging and Auditing |
16.6.11.C.01. - enhance system security and accountability. |
Shared |
n/a |
For each event identified as needing to be logged, agencies MUST ensure that the log facility records at least the following details, where applicable:
1. date and time of the event;
2. relevant system user(s) or processes;
3. event description;
4. success or failure of the event;
5. event source (e.g. application name); and
6. IT equipment location/identification. |
|
48 |
| NZISM_v3.7 |
16.6.12.C.01. |
NZISM_v3.7_16.6.12.C.01. |
NZISM v3.7 16.6.12.C.01. |
Event Logging and Auditing |
16.6.12.C.01. - maintain integrity of the data. |
Shared |
n/a |
Event logs MUST be protected from:
1. modification and unauthorised access; and
2. whole or partial loss within the defined retention period. |
|
48 |
| NZISM_v3.7 |
16.6.6.C.01. |
NZISM_v3.7_16.6.6.C.01. |
NZISM v3.7 16.6.6.C.01. |
Event Logging and Auditing |
16.6.6.C.01. - enhance security and reduce the risk of unauthorized access or misuse. |
Shared |
n/a |
Agencies MUST maintain system management logs for the life of a system. |
|
48 |
| NZISM_v3.7 |
16.6.7.C.01. |
NZISM_v3.7_16.6.7.C.01. |
NZISM v3.7 16.6.7.C.01. |
Event Logging and Auditing |
16.6.7.C.01. - facilitate effective monitoring, troubleshooting, and auditability of system operations. |
Shared |
n/a |
A system management log SHOULD record the following minimum information:
1. all system start-up and shutdown;
2. service, application, component or system failures;
3. maintenance activities;
4. backup and archival activities;
5. system recovery activities; and
6. special or out of hours activities. |
|
48 |
| NZISM_v3.7 |
16.6.9.C.01. |
NZISM_v3.7_16.6.9.C.01. |
NZISM v3.7 16.6.9.C.01. |
Event Logging and Auditing |
16.6.9.C.01. - enhance system security and accountability. |
Shared |
n/a |
Agencies MUST log, at minimum, the following events for all software components:
1. logons;
2. failed logon attempts;
3. logoffs;
4 .date and time;
5. all privileged operations;
6. failed attempts to elevate privileges;
7. security related system alerts and failures;
8. system user and group additions, deletions and modification to permissions; and
9. unauthorised or failed access attempts to systems and files identified as critical to the agency. |
|
46 |
| PCI_DSS_v4.0.1 |
10.2.1.2 |
PCI_DSS_v4.0.1_10.2.1.2 |
PCI DSS v4.0.1 10.2.1.2 |
Log and Monitor All Access to System Components and Cardholder Data |
Administrative Actions Logging |
Shared |
n/a |
Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts. |
|
24 |
| PCI_DSS_v4.0.1 |
10.4.2.1 |
PCI_DSS_v4.0.1_10.4.2.1 |
PCI DSS v4.0.1 10.4.2.1 |
Log and Monitor All Access to System Components and Cardholder Data |
Frequency of Log Reviews |
Shared |
n/a |
The frequency of periodic log reviews for all other system components (not defined in Requirement 10.4.1) is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1 |
|
25 |
| RBI_CSF_Banks_v2016 |
16.1 |
RBI_CSF_Banks_v2016_16.1 |
|
Maintenance, Monitoring, And Analysis Of Audit Logs |
Maintenance, Monitoring, And Analysis Of Audit Logs-16.1 |
|
n/a |
Consult all the stakeholders before finalising the scope, frequency and storage of log collection. |
|
5 |
| RBI_CSF_Banks_v2016 |
16.3 |
RBI_CSF_Banks_v2016_16.3 |
|
Maintenance, Monitoring, And Analysis Of Audit Logs |
Maintenance, Monitoring, And Analysis Of Audit Logs-16.3 |
|
n/a |
Enough care is to be taken tocapture audit logs pertaining to user actions in a system. Such arrangements should facilitate forensic auditing, if need be. |
|
4 |
| RBI_ITF_NBFC_v2017 |
3.1.g |
RBI_ITF_NBFC_v2017_3.1.g |
RBI IT Framework 3.1.g |
Information and Cyber Security |
Trails-3.1 |
|
n/a |
The IS Policy must provide for a IS framework with the following basic tenets:
Trails- NBFCs shall ensure that audit trails exist for IT assets satisfying its business requirements including regulatory and legal requirements, facilitating audit, serving as forensic evidence when required and assisting in dispute resolution. If an employee, for instance, attempts to access an unauthorized section, this improper activity should be recorded in the audit trail. |
link |
33 |
| RMiT_v1.0 |
10.66 |
RMiT_v1.0_10.66 |
RMiT 10.66 |
Security of Digital Services |
Security of Digital Services - 10.66 |
Shared |
n/a |
A financial institution must implement robust technology security controls in providing digital services which assure the following:
(a) confidentiality and integrity of customer and counterparty information and transactions;
(b) reliability of services delivered via channels and devices with minimum disruption to services;
(c) proper authentication of users or devices and authorisation of transactions;
(d) sufficient audit trail and monitoring of anomalous transactions;
(e) ability to identify and revert to the recovery point prior to incident or service disruption; and
(f) strong physical control and logical control measures |
link |
29 |
| SOC_2023 |
A1.1 |
SOC_2023_A1.1 |
SOC 2023 A1.1 |
Additional Criteria for Availability |
Effectively manage capacity demand and facilitate the implementation of additional capacity as needed. |
Shared |
n/a |
The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives. |
|
107 |
| SOC_2023 |
CC.5.3 |
SOC_2023_CC.5.3 |
404 not found |
|
|
|
n/a |
n/a |
|
35 |
| SOC_2023 |
CC2.3 |
SOC_2023_CC2.3 |
SOC 2023 CC2.3 |
Information and Communication |
Facilitate effective internal communication. |
Shared |
n/a |
Entity to communicate with external parties regarding matters affecting the functioning of internal control. |
|
214 |
| SOC_2023 |
CC4.1 |
SOC_2023_CC4.1 |
SOC 2023 CC4.1 |
Monitoring Activities |
Enhance the ability to manage risks and achieve objectives. |
Shared |
n/a |
The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
|
36 |
| SOC_2023 |
CC4.2 |
SOC_2023_CC4.2 |
SOC 2023 CC4.2 |
Monitoring Activities |
Facilitate timely corrective actions and strengthen the ability to maintain effective control over its operations and achieve its objectives. |
Shared |
n/a |
The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors. |
|
35 |
| SOC_2023 |
CC5.3 |
SOC_2023_CC5.3 |
SOC 2023 CC5.3 |
Control Activities |
Maintain alignment with organizational objectives and regulatory requirements. |
Shared |
n/a |
Entity deploys control activities through policies that establish what is expected and in procedures that put policies into action by establishing Policies and Procedures to Support Deployment of Management’s Directives, Responsibility and Accountability for Executing Policies and Procedures, perform tasks in a timely manner, taking corrective actions, perform using competent personnel and reassess policies and procedures. |
|
225 |
| SOC_2023 |
CC7.2 |
SOC_2023_CC7.2 |
SOC 2023 CC7.2 |
Systems Operations |
Maintain robust security measures and ensure operational resilience. |
Shared |
n/a |
The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events. |
|
163 |
| SOC_2023 |
CC7.4 |
SOC_2023_CC7.4 |
SOC 2023 CC7.4 |
Systems Operations |
Effectively manage security incidents, minimize their impact, and protect assets, operations, and reputation. |
Shared |
n/a |
The entity responds to identified security incidents by:
a. Executing a defined incident-response program to understand, contain, remediate, and communicate security incidents by assigning roles and responsibilities;
b. Establishing procedures to contain security incidents;
c. Mitigating ongoing security incidents, End Threats Posed by Security Incidents;
d. Restoring operations;
e. Developing and Implementing Communication Protocols for Security Incidents;
f. Obtains Understanding of Nature of Incident and Determines Containment Strategy;
g. Remediation Identified Vulnerabilities;
h. Communicating Remediation Activities; and,
i. Evaluating the Effectiveness of Incident Response and periodic incident evaluations. |
|
209 |
| SOC_2023 |
CC8.1 |
SOC_2023_CC8.1 |
SOC 2023 CC8.1 |
Change Management |
Minimise risks, ensure quality, optimise efficiency, and enhance resilience in the face of change. |
Shared |
n/a |
The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives by Managing Changes Throughout the System Life Cycle, authorizing changes, designing and developing changes, documenting all changes, tracking system changes, configuring software's, testing system changes, approving system changes, deploying system changes, identifying and evaluating system changes, creating baseline configurations for IT technologies and providing necessary changes in emergency situations. |
|
143 |
| SWIFT_CSCF_2024 |
6.4 |
SWIFT_CSCF_2024_6.4 |
SWIFT Customer Security Controls Framework 2024 6.4 |
Access Control |
Logging and Monitoring |
Shared |
1. Developing a logging and monitoring plan is the basis for effectively detecting abnormal behaviour and potential attacks and support further investigations.
2. As the operational environment becomes more complex, so will the logging and monitoring capability needed to perform adequate detection. Simplifying the operational environment will enable simpler logging and monitoring. |
To record security events, detect and respond to anomalous actions and operations within the user’s Swift environment. |
|
38 |
| SWIFT_CSCF_v2021 |
6.4 |
SWIFT_CSCF_v2021_6.4 |
SWIFT CSCF v2021 6.4 |
Detect Anomalous Activity to Systems or Transaction Records |
Logging and Monitoring |
|
n/a |
Record security events and detect anomalous actions and operations within the local SWIFT environment. |
link |
29 |
| SWIFT_CSCF_v2022 |
6.4 |
SWIFT_CSCF_v2022_6.4 |
SWIFT CSCF v2022 6.4 |
6. Detect Anomalous Activity to Systems or Transaction Records |
Record security events and detect anomalous actions and operations within the local SWIFT environment. |
Shared |
n/a |
Capabilities to detect anomalous activity are implemented, and a process or tool is in place to keep and review logs. |
link |
47 |