PR.PS-04: Log records are generated and made available for continuous monitoring
Subcategory is new to this version of the framework and incorporates the following item from the previous version: PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.
Description
[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]
Implementation Examples
1st: 1st Party Risk
Ex1: Configure all operating systems, applications, and services (including cloud-based services) to generate log records
Ex2: Configure log generators to securely share their logs with the organization's logging infrastructure systems and services
Ex3: Configure log generators to record the data needed by zero-trust architectures
Related Controls
NIST Special Publication 800-53 Revision 5.2.0
AU-2: Event Logging
Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types]; Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; Specify the following event types for logging within the…
AU-3: Content of Audit Records
Ensure that audit records contain information that establishes the following: What type of event occurred; When the event occurred; Where the event occurred; Source of the event; Outcome of the event; and Identity of any individuals, subjects, or objects/entities associated with the event.
AU-6: Audit Record Review, Analysis, and Reporting
Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; Report findings to [Assignment: organization-defined personnel or roles] ; and Adjust the level of audit record review, analysis, and reporting within the system when there is a…
AU-7: Audit Record Reduction and Report Generation
Provide and implement an audit record reduction and report generation capability that: Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and Does not alter the original content or time ordering of audit records.
AU-11: Audit Record Retention
Retain audit records for [Assignment: organization-defined time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
AU-12: Audit Record Generation
Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: organization-defined system components]; Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and Generate audit records for the event types defined…
NIST SP 800-171 Revision 3.0
03.03.02: Audit Record Content
Include the following content in audit records: What type of event occurred When the event occurred Where the event occurred Source of the event Outcome of the event Identity of the individuals, subjects, objects, or entities associated with the event Provide additional information for audit records as needed.
03.03.03: Audit Record Generation
Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02. Retain audit records for a time period consistent with the records retention policy.
03.03.05: Audit Record Review, Analysis, and Reporting
Review and analyze system audit records [Assignment: organization-defined frequency] for indications and the potential impact of inappropriate or unusual activity. Report findings to organizational personnel or roles. Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
03.03.06: Audit Record Reduction and Report Generation
Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents. Preserve the original content and time ordering of audit records.
Cloud Controls Matrix v4.0
IAM-16: Authorization Mechanisms
Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.
LOG-01: Logging and Monitoring Policy and Procedures
Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for logging and monitoring. Review and update the policies and procedures at least annually.
LOG-02: Audit Logs Protection
Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.
LOG-03: Security Monitoring and Alerting
Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.
LOG-04: Audit Logs Access and Accountability
Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.
LOG-05: Audit Logs Monitoring and Response
Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.
LOG-07: Logging Scope
Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.
LOG-08: Log Records
Generate audit records containing relevant security information.
LOG-10: Encryption Monitoring and Reporting
Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.
LOG-11: Transaction/Activity Logging
Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.
LOG-12: Access Control Logs
Monitor and log physical access using an auditable access control system.
LOG-13: Failures and Anomalies Reporting
Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.
Critical Security Controls Version 8.1
8.2: Collect Audit Logs
Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.