compliance controls are associated with this Policy definition 'Retain terminated user data' (7c7032fe-9ce6-9092-5890-87a1a3755db1)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CIS_Azure_1.1.0 |
4.18 |
CIS_Azure_1.1.0_4.18 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.18 |
4 Database Services |
Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_retention_days' on 'PostgreSQL Servers'. |
link |
4 |
| CIS_Azure_1.1.0 |
4.3 |
CIS_Azure_1.1.0_4.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3 |
4 Database Services |
Ensure that 'Auditing' Retention is 'greater than 90 days' |
Shared |
The customer is responsible for implementing this recommendation. |
SQL Server Audit Retention should be configured to be greater than 90 days. |
link |
5 |
| CIS_Azure_1.1.0 |
5.1.1 |
CIS_Azure_1.1.0_5.1.1 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.1 |
5 Logging and Monitoring |
Ensure that a Log Profile exists |
Shared |
The customer is responsible for implementing this recommendation. |
Enable log profile for exporting activity logs. |
link |
5 |
| CIS_Azure_1.1.0 |
5.1.2 |
CIS_Azure_1.1.0_5.1.2 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.2 |
5 Logging and Monitoring |
Ensure that Activity Log Retention is set 365 days or greater |
Shared |
The customer is responsible for implementing this recommendation. |
Ensure activity log retention is set for 365 days or greater. |
link |
4 |
| CIS_Azure_1.1.0 |
5.1.3 |
CIS_Azure_1.1.0_5.1.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.3 |
5 Logging and Monitoring |
Ensure audit profile captures all the activities |
Shared |
The customer is responsible for implementing this recommendation. |
The log profile should be configured to export all activities from the control/management plane. |
link |
5 |
| CIS_Azure_1.1.0 |
5.1.4 |
CIS_Azure_1.1.0_5.1.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.1.4 |
5 Logging and Monitoring |
Ensure the log profile captures activity logs for all regions including global |
Shared |
The customer is responsible for implementing this recommendation. |
Configure the log profile to export activities from all Azure supported regions/locations including global. |
link |
5 |
| CIS_Azure_1.1.0 |
6.4 |
CIS_Azure_1.1.0_6.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 6.4 |
6 Networking |
Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' |
Shared |
The customer is responsible for implementing this recommendation. |
Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days. |
link |
3 |
| CIS_Azure_1.3.0 |
4.1.3 |
CIS_Azure_1.3.0_4.1.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.1.3 |
4 Database Services |
Ensure that 'Auditing' Retention is 'greater than 90 days' |
Shared |
The customer is responsible for implementing this recommendation. |
SQL Server Audit Retention should be configured to be greater than 90 days. |
link |
5 |
| CIS_Azure_1.3.0 |
4.3.7 |
CIS_Azure_1.3.0_4.3.7 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.7 |
4 Database Services |
Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_retention_days' on 'PostgreSQL Servers'. |
link |
4 |
| CIS_Azure_1.3.0 |
5.3 |
CIS_Azure_1.3.0_5.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.3 |
5 Logging and Monitoring |
Ensure that Diagnostic Logs are enabled for all services which support it. |
Shared |
The customer is responsible for implementing this recommendation. |
Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs
for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.
A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.
Note: The CIS Benchmark covers some specific Diagnostic Logs
separately.
'''
3.3 - Ensure Storage logging is enabled for Queue service for read, write, and delete requests
6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
''' |
link |
20 |
| CIS_Azure_1.3.0 |
6.4 |
CIS_Azure_1.3.0_6.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 6.4 |
6 Networking |
Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' |
Shared |
The customer is responsible for implementing this recommendation. |
Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days. |
link |
3 |
| CIS_Azure_1.4.0 |
4.1.3 |
CIS_Azure_1.4.0_4.1.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.1.3 |
4 Database Services |
Ensure that 'Auditing' Retention is 'greater than 90 days' |
Shared |
The customer is responsible for implementing this recommendation. |
SQL Server Audit Retention should be configured to be greater than 90 days. |
link |
5 |
| CIS_Azure_1.4.0 |
4.3.6 |
CIS_Azure_1.4.0_4.3.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.6 |
4 Database Services |
Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server |
Shared |
The customer is responsible for implementing this recommendation. |
Enable 'log_retention_days' on 'PostgreSQL Servers'. |
link |
4 |
| CIS_Azure_1.4.0 |
5.3 |
CIS_Azure_1.4.0_5.3 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.3 |
5 Logging and Monitoring |
Ensure that Diagnostic Logs Are Enabled for All Services that Support it. |
Shared |
The customer is responsible for implementing this recommendation. |
Diagnostic Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself, for example, getting a secret from a Key Vault. Currently, 32 Azure resources support Diagnostic Logging (See the references section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps and CosmosDB. The content of these logs varies by resource type. For example, Windows event system logs are a category of diagnostics logs
for VMs, and blob, table, and queue logs are categories of diagnostics logs for storage accounts.
A number of back-end services were not configured to log and store Diagnostic Logs for certain activities or for a sufficient length. It is crucial that logging systems are correctly configured to log all relevant activities and retain those logs for a sufficient length of time. By default, Diagnostic Logs are not enabled. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.
Note: The CIS Benchmark covers some specific Diagnostic Logs
separately.
'''
3.3 - Ensure Storage logging is enabled for Queue service for read, write, and delete requests
6.4 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
''' |
link |
20 |
| CIS_Azure_1.4.0 |
6.4 |
CIS_Azure_1.4.0_6.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 6.4 |
6 Networking |
Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' |
Shared |
The customer is responsible for implementing this recommendation. |
Network Security Group Flow Logs should be enabled and the retention period is set to greater than or equal to 90 days. |
link |
3 |
| CIS_Azure_2.0.0 |
4.1.6 |
CIS_Azure_2.0.0_4.1.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.1.6 |
4.1 |
Ensure that 'Auditing' Retention is 'greater than 90 days' |
Shared |
n/a |
SQL Server Audit Retention should be configured to be greater than 90 days.
Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access. |
link |
5 |
| CIS_Azure_2.0.0 |
4.3.6 |
CIS_Azure_2.0.0_4.3.6 |
CIS Microsoft Azure Foundations Benchmark recommendation 4.3.6 |
4.3 |
Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server |
Shared |
Configuring this setting will result in logs being retained for the specified number of days. If this is configured on a high traffic server, the log may grow quickly to occupy a large amount of disk space. In this case you may want to set this to a lower number. |
Ensure `log_retention_days` on `PostgreSQL Servers` is set to an appropriate value.
Configuring `log_retention_days` determines the duration in days that `Azure Database for PostgreSQL` retains log files. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. |
link |
4 |
| CIS_Azure_2.0.0 |
5.4 |
CIS_Azure_2.0.0_5.4 |
CIS Microsoft Azure Foundations Benchmark recommendation 5.4 |
5 |
Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it |
Shared |
Costs for monitoring varies with Log Volume. Not every resource needs to have logging enabled. It is important to determine the security classification of the data being processed by the given resource and adjust the logging based on which events need to be tracked. This is typically determined by governance and compliance requirements. |
Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type.
A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.
A lack of monitoring reduces the visibility into the data plane, and therefore an organization's ability to detect reconnaissance, authorization attempts or other malicious activity. Unlike Activity Logs, Resource Logs are not enabled by default. Specifically, without monitoring it would be impossible to tell which entities had accessed a data store that was breached. In addition, alerts for failed attempts to access APIs for Web Services or Databases are only possible when logging is enabled. |
link |
20 |
| CIS_Azure_2.0.0 |
6.5 |
CIS_Azure_2.0.0_6.5 |
CIS Microsoft Azure Foundations Benchmark recommendation 6.5 |
6 |
Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' |
Shared |
This will keep IP traffic logs for longer than 90 days. As a level 2, first determine your need to retain data, then apply your selection here. As this is data stored for longer, your monthly storage costs will increase depending on your data use. |
Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.
Flow logs enable capturing information about IP traffic flowing in and out of network security groups. Logs can be used to check for anomalies and give insight into suspected breaches. |
link |
3 |
| FedRAMP_High_R4 |
AU-11 |
FedRAMP_High_R4_AU-11 |
FedRAMP High AU-11 |
Audit And Accountability |
Audit Record Retention |
Shared |
n/a |
The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
Supplemental Guidance: Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention. Related controls: AU-4, AU-5, AU-9, MP-6.
References: None. |
link |
4 |
| FedRAMP_High_R4 |
PS-4 |
FedRAMP_High_R4_PS-4 |
FedRAMP High PS-4 |
Personnel Security |
Personnel Termination |
Shared |
n/a |
The organization, upon termination of individual employment:
a. Disables information system access within [Assignment: organization-defined time period];
b. Terminates/revokes any authenticators/credentials associated with the individual;
c. Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];
d. Retrieves all security-related organizational information system-related property;
e. Retains access to organizational information and information systems formerly controlled by terminated individual; and
f. Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
Supplemental Guidance: Information system-related property includes, for example, hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for information system-related property. Security topics of interest at exit interviews can include, for example, reminding terminated individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not be possible for some terminated individuals, for example, in cases related to job abandonment, illnesses, and nonavailability of supervisors. Exit interviews are important for individuals with security clearances. Timely execution of termination actions is essential for individuals terminated for cause. In certain situations, organizations consider disabling the information system accounts of individuals that are being terminated prior to the individuals being notified. Related controls: AC-2, IA-4, PE-2, PS-5, PS-6.
References: None. |
link |
5 |
| FedRAMP_Moderate_R4 |
AU-11 |
FedRAMP_Moderate_R4_AU-11 |
FedRAMP Moderate AU-11 |
Audit And Accountability |
Audit Record Retention |
Shared |
n/a |
The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
Supplemental Guidance: Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention. Related controls: AU-4, AU-5, AU-9, MP-6.
References: None. |
link |
4 |
| FedRAMP_Moderate_R4 |
PS-4 |
FedRAMP_Moderate_R4_PS-4 |
FedRAMP Moderate PS-4 |
Personnel Security |
Personnel Termination |
Shared |
n/a |
The organization, upon termination of individual employment:
a. Disables information system access within [Assignment: organization-defined time period];
b. Terminates/revokes any authenticators/credentials associated with the individual;
c. Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];
d. Retrieves all security-related organizational information system-related property;
e. Retains access to organizational information and information systems formerly controlled by terminated individual; and
f. Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
Supplemental Guidance: Information system-related property includes, for example, hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for information system-related property. Security topics of interest at exit interviews can include, for example, reminding terminated individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not be possible for some terminated individuals, for example, in cases related to job abandonment, illnesses, and nonavailability of supervisors. Exit interviews are important for individuals with security clearances. Timely execution of termination actions is essential for individuals terminated for cause. In certain situations, organizations consider disabling the information system accounts of individuals that are being terminated prior to the individuals being notified. Related controls: AC-2, IA-4, PE-2, PS-5, PS-6.
References: None. |
link |
5 |
| hipaa |
0701.07a1Organizational.12-07.a |
hipaa-0701.07a1Organizational.12-07.a |
0701.07a1Organizational.12-07.a |
07 Vulnerability Management |
0701.07a1Organizational.12-07.a 07.01 Responsibility for Assets |
Shared |
n/a |
An inventory of assets and services is maintained. |
|
7 |
| hipaa |
1109.01b1System.479-01.b |
hipaa-1109.01b1System.479-01.b |
1109.01b1System.479-01.b |
11 Access Control |
1109.01b1System.479-01.b 01.02 Authorized Access to Information Systems |
Shared |
n/a |
User registration and deregistration, at a minimum: (i) communicates relevant policies to users and require acknowledgement (e.g., signed or captured electronically); (ii) checks authorization and minimum level of access necessary prior to granting access; (iii) ensures access is appropriate to the business needs (consistent with sensitivity/risk and does not violate segregation of duties requirements); (iv) addresses termination and transfer; (v) ensures default accounts are removed and/or renamed; (vi) removes or blocks critical access rights of users who have changed roles or jobs; and, (vii) automatically removes or disables inactive accounts. |
|
24 |
| hipaa |
11154.02i1Organizational.5-02.i |
hipaa-11154.02i1Organizational.5-02.i |
11154.02i1Organizational.5-02.i |
11 Access Control |
11154.02i1Organizational.5-02.i 02.04 Termination or Change of Employment |
Shared |
n/a |
Access rights to information assets and facilities is reduced or removed before the employment or other workforce arrangement terminates or changes, depending on the evaluation of risk factors. |
|
8 |
| hipaa |
11155.02i2Organizational.2-02.i |
hipaa-11155.02i2Organizational.2-02.i |
11155.02i2Organizational.2-02.i |
11 Access Control |
11155.02i2Organizational.2-02.i 02.04 Termination or Change of Employment |
Shared |
n/a |
The organization employs automated mechanisms to notify specific personnel or roles (formally defined by the organization) upon termination of an individual. |
|
10 |
| hipaa |
11220.01b1System.10-01.b |
hipaa-11220.01b1System.10-01.b |
11220.01b1System.10-01.b |
11 Access Control |
11220.01b1System.10-01.b 01.02 Authorized Access to Information Systems |
Shared |
n/a |
User registration and de-registration formally address establishing, activating, modifying, reviewing, disabling and removing accounts. |
|
26 |
| hipaa |
1135.02i1Organizational.1234-02.i |
hipaa-1135.02i1Organizational.1234-02.i |
1135.02i1Organizational.1234-02.i |
11 Access Control |
1135.02i1Organizational.1234-02.i 02.04 Termination or Change of Employment |
Shared |
n/a |
Upon termination or changes in employment for employees, contractors, third-party users, or other workforce arrangement, physical and logical access rights and associated materials (e.g., passwords, keycards, keys, documentation that identify them as current members of the organization) are removed or modified to restrict access within 24 hours and old accounts are closed after 90 days of opening new accounts. |
|
9 |
| hipaa |
1136.02i2Organizational.1-02.i |
hipaa-1136.02i2Organizational.1-02.i |
1136.02i2Organizational.1-02.i |
11 Access Control |
1136.02i2Organizational.1-02.i 02.04 Termination or Change of Employment |
Shared |
n/a |
For instances of increased risk, physical, and logical access rights are immediately removed or modified following employee, contractor or third-party user termination, and allow for immediate escorting from the site, if necessary. |
|
6 |
| hipaa |
1207.09aa2System.4-09.aa |
hipaa-1207.09aa2System.4-09.aa |
1207.09aa2System.4-09.aa |
12 Audit Logging & Monitoring |
1207.09aa2System.4-09.aa 09.10 Monitoring |
Shared |
n/a |
Audit records are retained for 90 days and older audit records are archived for one year. |
|
13 |
| hipaa |
1210.09aa3System.3-09.aa |
hipaa-1210.09aa3System.3-09.aa |
1210.09aa3System.3-09.aa |
12 Audit Logging & Monitoring |
1210.09aa3System.3-09.aa 09.10 Monitoring |
Shared |
n/a |
All disclosures of covered information within or outside of the organization are logged including type of disclosure, date/time of the event, recipient, and sender. |
|
11 |
| hipaa |
1908.06.c1Organizational.4-06.c |
hipaa-1908.06.c1Organizational.4-06.c |
1908.06.c1Organizational.4-06.c |
19 Data Protection & Privacy |
1908.06.c1Organizational.4-06.c 06.01 Compliance with Legal Requirements |
Shared |
n/a |
The organization documents and maintains (i) designated record sets that are subject to access by individuals, and (ii) titles of the persons or office responsible for receiving and processing requests for access by individuals as organizational records for a period of six years. |
|
11 |
| hipaa |
19142.06c1Organizational.8-06.c |
hipaa-19142.06c1Organizational.8-06.c |
19142.06c1Organizational.8-06.c |
19 Data Protection & Privacy |
19142.06c1Organizational.8-06.c 06.01 Compliance with Legal Requirements |
Shared |
n/a |
Guidelines are issued by the organization on the ownership, classification, retention, storage, handling and disposal of all records and information. |
|
9 |
| hipaa |
19144.06c2Organizational.1-06.c |
hipaa-19144.06c2Organizational.1-06.c |
19144.06c2Organizational.1-06.c |
19 Data Protection & Privacy |
19144.06c2Organizational.1-06.c 06.01 Compliance with Legal Requirements |
Shared |
n/a |
The organization has established a formal records document retention program. |
|
7 |
| hipaa |
19145.06c2Organizational.2-06.c |
hipaa-19145.06c2Organizational.2-06.c |
19145.06c2Organizational.2-06.c |
19 Data Protection & Privacy |
19145.06c2Organizational.2-06.c 06.01 Compliance with Legal Requirements |
Shared |
n/a |
Specific controls for record storage, access, retention, and destruction have been implemented. |
|
8 |
| ISO27001-2013 |
A.12.4.1 |
ISO27001-2013_A.12.4.1 |
ISO 27001:2013 A.12.4.1 |
Operations Security |
Event Logging |
Shared |
n/a |
Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. |
link |
53 |
| ISO27001-2013 |
A.16.1.7 |
ISO27001-2013_A.16.1.7 |
ISO 27001:2013 A.16.1.7 |
Information Security Incident Management |
Collection of evidence |
Shared |
n/a |
The organization shall define and apply procedures for the identification, collection, acquisition and preservation of information which can serve as evidence. |
link |
7 |
| ISO27001-2013 |
A.7.3.1 |
ISO27001-2013_A.7.3.1 |
ISO 27001:2013 A.7.3.1 |
Human Resources Security |
Termination or change of employment responsibilities |
Shared |
n/a |
Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, communicated to the employee or contractor and enforced. |
link |
8 |
| ISO27001-2013 |
A.8.1.4 |
ISO27001-2013_A.8.1.4 |
ISO 27001:2013 A.8.1.4 |
Asset Management |
Return of assets |
Shared |
n/a |
All employees and external party users shall return all of the organizational assets in their possession upon termination of their employment, contract or agreement. |
link |
8 |
| ISO27001-2013 |
C.9.2.g |
ISO27001-2013_C.9.2.g |
ISO 27001:2013 C.9.2.g |
Performance Evaluation |
Internal audit |
Shared |
n/a |
The organization shall conduct internal audits at planned intervals to provide information on whether
the information security management system:
g) retain documented information as evidence of the audit programme(s) and the audit results. |
link |
3 |
| NIST_SP_800-171_R2_3 |
.3.1 |
NIST_SP_800-171_R2_3.3.1 |
NIST SP 800-171 R2 3.3.1 |
Audit and Accountability |
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
An event is any observable occurrence in a system, which includes unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed as those events which are significant and relevant to the security of systems and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, failed logons or failed accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the monitoring and auditing appropriate for each of the CUI security requirements. Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access both successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. Organizations consider in the definition of event types, the logging necessary to cover related events such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures. Audit record content that may be necessary to satisfy this requirement includes time stamps, source and destination addresses, user or process identifiers, event descriptions, success or fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). Detailed information that organizations may consider in audit records includes full text recording of privileged commands or the individual identities of group account users. Organizations consider limiting the additional audit log information to only that information explicitly needed for specific audit requirements. This facilitates the use of audit trails and audit logs by not including information that could potentially be misleading or could make it more difficult to locate information of interest. Audit logs are reviewed and analyzed as often as needed to provide important information to organizations to facilitate risk-based decision making. [SP 800-92] provides guidance on security log management. |
link |
53 |
| NIST_SP_800-53_R4 |
AU-11 |
NIST_SP_800-53_R4_AU-11 |
NIST SP 800-53 Rev. 4 AU-11 |
Audit And Accountability |
Audit Record Retention |
Shared |
n/a |
The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
Supplemental Guidance: Organizations retain audit records until it is determined that they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on record retention. Related controls: AU-4, AU-5, AU-9, MP-6.
References: None. |
link |
4 |
| NIST_SP_800-53_R4 |
PS-4 |
NIST_SP_800-53_R4_PS-4 |
NIST SP 800-53 Rev. 4 PS-4 |
Personnel Security |
Personnel Termination |
Shared |
n/a |
The organization, upon termination of individual employment:
a. Disables information system access within [Assignment: organization-defined time period];
b. Terminates/revokes any authenticators/credentials associated with the individual;
c. Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];
d. Retrieves all security-related organizational information system-related property;
e. Retains access to organizational information and information systems formerly controlled by terminated individual; and
f. Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
Supplemental Guidance: Information system-related property includes, for example, hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for information system-related property. Security topics of interest at exit interviews can include, for example, reminding terminated individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not be possible for some terminated individuals, for example, in cases related to job abandonment, illnesses, and nonavailability of supervisors. Exit interviews are important for individuals with security clearances. Timely execution of termination actions is essential for individuals terminated for cause. In certain situations, organizations consider disabling the information system accounts of individuals that are being terminated prior to the individuals being notified. Related controls: AC-2, IA-4, PE-2, PS-5, PS-6.
References: None. |
link |
5 |
| NIST_SP_800-53_R5 |
AU-11 |
NIST_SP_800-53_R5_AU-11 |
NIST SP 800-53 Rev. 5 AU-11 |
Audit and Accountability |
Audit Record Retention |
Shared |
n/a |
Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. |
link |
4 |
| NIST_SP_800-53_R5 |
PS-4 |
NIST_SP_800-53_R5_PS-4 |
NIST SP 800-53 Rev. 5 PS-4 |
Personnel Security |
Personnel Termination |
Shared |
n/a |
Upon termination of individual employment:
a. Disable system access within [Assignment: organization-defined time period];
b. Terminate or revoke any authenticators and credentials associated with the individual;
c. Conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics];
d. Retrieve all security-related organizational system-related property; and
e. Retain access to organizational information and systems formerly controlled by terminated individual. |
link |
5 |
| PCI_DSS_v4.0 |
10.5.1 |
PCI_DSS_v4.0_10.5.1 |
PCI DSS v4.0 10.5.1 |
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data |
Audit log history is retained and available for analysis |
Shared |
n/a |
Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis. |
link |
3 |
| PCI_DSS_v4.0 |
5.3.4 |
PCI_DSS_v4.0_5.3.4 |
PCI DSS v4.0 5.3.4 |
Requirement 05: Protect All Systems and Networks from Malicious Software |
Anti-malware mechanisms and processes are active, maintained, and monitored |
Shared |
n/a |
Audit logs for the anti-malware solution are enabled and retained in accordance with Requirement 10.5.1. |
link |
4 |