Logging and Monitoring Policy

1. Purpose

This policy makes sure that systems record enough reliable information to detect misuse, attacks, faults and policy breaches, to investigate them, and to give evidence for legal, regulatory and audit needs. It also sets limits on monitoring so that it respects privacy and is proportionate.

2. Scope

The policy applies to every system, application, network device, security tool, cloud service and endpoint that processes Organisation information, and to the people who administer or monitor them.

• In scope: operating systems, directories, databases, applications, web and API gateways, firewalls, VPN, DNS, email, endpoint protection, cloud control planes, physical access systems and the logging platform itself.
• Out of scope: content of personal communications of staff, except as allowed under the monitoring conditions in this policy.

3. Terms and Definitions

4. Roles and Responsibilities

5. Policy Statements

5.1 Event logging

• Every in-scope system must produce logs that include, as a minimum, the events in the table below, and each record must carry timestamp, source, user or process identity, action, object and result.
• Logs must be sent to the central log platform in near real time, within [5 minutes], and must not rely only on a copy held on the source system.
• System clocks must be synchronised to a common, reliable time source and checked for drift above [1 second]. Time zone must be recorded in a consistent way.

5.2 Protection of logs

• Logs must be protected from unauthorised change and deletion. Access to the log platform must be limited to named people, with multi-factor authentication, and use of it logged.
• System administrators must not be able to alter or delete logs of their own activity; the platform must keep logs in write-once or tamper-evident storage, or use hash chaining, for security-relevant records.
• Logs may hold personal data, passwords or secrets by accident. Applications must mask passwords, tokens, payment data and sensitive personal data before logging.
• The log platform must be sized, backed up and monitored for capacity and ingestion failure. A source that stops sending logs for more than [30 minutes] raises an alert.

5.3 Retention

Where the minimum periods differ, the longer applies. Logs must be deleted when the period ends, unless a legal hold applies. Where logs hold personal data, retention follows the Data Protection and Privacy Policy.

5.4 Monitoring and detection

• Security operations must monitor alerts [24 hours a day] for Tier 1 systems, and during [business hours] for others, or use an equivalent managed service under contract with defined response times.
• Detection rules must cover at least: repeated failed logins, logins from impossible locations, privilege escalation, new administrator accounts, disabled logging, malware alerts, large data transfers, access to sensitive data outside normal patterns, and communication with known malicious addresses.
• Rules must be reviewed each [quarter] against current threats from the Threat Intelligence Policy and tuned to reduce noise. Each rule has an owner and a documented response action.
• Alerts must be triaged by severity: critical within [15 minutes], high within [1 hour], medium within [1 working day], low within [5 working days]. Events that meet the definition of an incident are escalated under the Information Security Incident Management Policy.
• Cyber incidents subject to reporting duties are reported to the authority within [6 hours] of the Organisation noticing them, as set out in the CERT-In Directions of 28 April 2022 [confirm the current requirement].

5.5 Privacy and proportionality

• Monitoring of staff activity is limited to what is needed for security and compliance, is described in the Acceptable Usage Policy and in the notice given to staff, and is not used for other purposes without the data protection officer's approval.
• Content inspection of personal communications, and targeted monitoring of a named person, needs written approval from the Head of IT Security, HR and legal, and must be time-limited and recorded.
• Access to logs is on a need-to-know basis, and every investigator use of logs holding personal data is recorded in the case file.

5.6 Review of administrator and privileged activity

• Privileged sessions on Tier 1 systems must be recorded or logged in enough detail to reconstruct actions, and a sample of at least [10%] of privileged sessions is reviewed each month.
• Use of break-glass accounts raises a critical alert and must be reviewed within [1 working day] against the approved ticket.

6. Compliance and Monitoring

The Logging and Monitoring Procedure sets out the steps for onboarding a log source, tuning detection rules and handling alerts.

7. Measures

8. Records and Evidence

• Logs, in line with the retention table.
• Alert triage records and investigation notes, kept for [2 years].
• Log source register, detection rule register and test results, kept while current plus [2 years].
• Approvals for targeted monitoring, kept for [5 years].

Annexure A: Log source register

9. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

10. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

11. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Logging and Monitoring Procedure
• Information Security Incident Management Policy
• Incident Management Procedure
• Access Control Policy
• Data Protection and Privacy Policy
• Communications and Operations Security Policy
• Information Security Monitoring and Compliance Policy