Logging and monitoring standard

Produce, store, protect and analyse logs of activities, exceptions and faults.

What the ISO 27002 guidance expects the document to say: Requires logs to be produced, stored, protected and analysed, covering activities, exceptions, faults and any other event of relevance. Older source material adds that records of user activity, exceptions and security events should be retained for an agreed period to support later investigation and access control monitoring, and that faults should be logged, analysed and acted on.

Monitor networks, systems and applications for anomalies and act on potential incidents.

What the ISO 27002 guidance expects the document to say: Requires networks, systems and applications to be monitored for anomalous behaviour, with appropriate action taken to evaluate whether what is observed constitutes an information security incident. Secondary commentary notes the deliberate shift to anomalous behaviour as the trigger, responding to cloud era risk.

A process shall be in place to review event logs, by continuous automated monitoring and alerting or by manual review at a specified, documented periodicity, to identify irregularities and propose remediation; where possible event logs shall record access to PII including by whom, when, which PII principal's PII was accessed and what additions, modifications or deletions were made; where several service providers share roles in logging, the roles and any agreement on log access shall be defined and documented. Log information can itself contain PII, so access to it shall be controlled to ensure it is used only as intended, and a procedure, preferably automatic, shall delete or de-identify logged information as the retention schedule specifies. A PII processor shall define and make available to customers the criteria for if, when and how log information is made available to them, and where customers can access logs the processor controls it shall ensure each customer can access only records of its own activities and cannot amend the logs.

Event logs shall be generated and recorded during AI system operations to enable monitoring, accountability, and incident investigation.

Financial entities shall have mechanisms to promptly detect anomalous activities, ICT network performance issues and ICT-related incidents, with multiple layers of control, defined alert thresholds and detection processes that enable timely incident response.