For critical applications, all add, change/modify, and delete activities or transactions must generate a log entry. Each log entry should contain the following information:
-
- User identification information
- Type of event
- Date and time stamp
- Success or failure indication
- Origination of event
- Identity or name of the affected data, system component, or resource
Protecting logs:
-
- Verify that audit trails are enabled and active for system components
- Ensure that only individuals who have a job-related need can view audit trail files
- Confirm that the current audit trail files are protected from unauthorized modifications via access control mechanisms, physical segregation, and/or network segregation
- Ensure that the current audit trail files are promptly backed up to a centralized log server or media that is difficult to alter...