Monitoring, Logging, and Auditing

Authorizing Log Access

Evaluating Configurations

Persistently evaluate and test the configuration of machine-based information resources, especially infrastructure as code.

Logging Event Types

Maintain a list of information resources and event types that will be logged, monitored, and audited, then do so.

Operating SIEM Capability

Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistent logging of events, activities, and changes.

Reviewing Logs

Persistently review and audit logs.