QS0027-01: Log Management Policy

Question 1

QS0027-01: Log Management Policy

How long should logs be retained?

Answer 1

Retain logs for a minimum of 45 days.

Question 2

QS0027-01: Log Management Policy

What should be included in log contents?

Answer 2

1. User identification
2. Date and time of the event
3. Component of the information system (e.g., software component, a hardware component) where the event occurred
4. Type of event
5. Subject identity
6. Outcome of the event

Question 3

QS0027-01: Log Management Policy

What security events should be logged?

Answer 3

SOP has a lot of details, but in summary, configuration changes to auditing, roles, user setup. All login attempts and logouts.