Solved

ISO 27002 log retention length requirements

Posted on 2008-06-11
1
1,486 Views
Last Modified: 2008-06-12
Does anyone know what the ISO 27002 log retention length requirements are, if there are any?  Is there a reference that I can review?
0
Comment
Question by:Sysdeath
1 Comment
 
LVL 37

Accepted Solution

by:
bbao earned 500 total points
ID: 21766682
the reference is just the standard itself.

as per section 10.10.1 Audit logging of ISO/IEC 27002,

"Audit logs should include, when relevant:

a) user IDs;
b) dates, times, and details of key events, e.g. log-on and log-off;
c) terminal identity or location if possible;
d) records of successful and rejected system access attempts;
e) records of successful and rejected data and other resource access attempts;
f) changes to system configuration;
g) use of privileges;
h) use of system utilities and applications;
i) files accessed and the kind of access;
j) network addresses and protocols;
k) alarms raised by the access control system;
l) activation and de-activation of protection systems, such as anti-virus systems and intrusion detection systems."

there is no particular *length* requirements in the standard, as a log should be the content of what actually happened, not the amount.

for more information, you may read section 10.10 Monitoring

hope it helps,
bbao
0

Featured Post

Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Ways to verify USB ports are blocked on 30,000 PCs/laptops 12 137
SSH over http/https 8 123
How can I know if to trust a tool offered on a site 6 96
EXCHANGE 2007, EXCHANGE 2013 8 78
With healthcare moving into the digital age with things like Healthcare.gov, the digitization of patient records and video conferencing with patients, data has a much greater chance of being exposed than ever before.
How do we balance the user experience (UX) with reasonable security measures? It can be done, if you keep these fundamentals in mind.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question