NIST CSF 2.0, ProtectPR.PS-04

Lay down procedures and use tools to monitor and log activities on your network and information systems, maintain, document and review the logs, and establish a list of the assets to be subject to logging based on your risk assessment. Where appropriate, include in the logs network traffic, changes to users and permissions, access to systems and applications, authentication events, privileged and administrator activity, access to or changes of critical configuration and backup files, security tool logs, use of system resources, physical access, use of network equipment, and the activation, stopping and pausing of logs, and environmental events. Review the logs regularly for unusual or unwanted trends and start a qualified response in a timely manner when an alarm is triggered. Maintain and back up the logs for a predefined period, protect them from unauthorized access or changes, and, to the extent feasible, synchronize the time sources of all systems and make your monitoring and logging systems redundant (points 3.2.1 and 3.2.3 to 3.2.6).

Develop, document and implement logging procedures, protocols and tools that identify the events to be logged and the retention period (set it taking into account your business and information security objectives, the reason for recording the event in the logs and the results of your ICT risk assessment), log events related to access control, identity management, capacity management, change management, ICT operations and network traffic, protect logs against tampering, deletion and unauthorized access, detect failures of logging systems, and synchronize the clocks of your ICT systems to a documented reliable reference time source (Article 12).

Ensure secure identification when communicating between the payer's device and the payee's acceptance devices for electronic payments, and effectively mitigate the risks of misdirection of communication to unauthorized parties in mobile applications and other interfaces offering electronic payment services. Have processes that make all payment transactions and other interactions traceable, with a unique identifier of each communication session, detailed logging of the transaction and timestamps synchronized according to an official time signal (Articles 28 and 29).

Comply with the national cybersecurity authority's directives on retaining, for one year from generation, the technical data needed to identify a cybersecurity incident, including connection data, system logs, and the security-event traces your operating systems, applications and security products generate.

The Department says you should consider whether your logging and security event alerting capabilities are sufficient to address heightened threats, and review and test your threat-relevant operational resilience procedures, which may require more frequent use as AI-enabled cyber capabilities evolve.

If you are a Class A company as 23 NYCRR 500.1(d) defines it, implement an endpoint detection and response solution to monitor anomalous activity, including lateral movement, and a solution that centralizes logging and security event alerting, unless your Chief Information Security Officer has approved in writing the use of reasonably equivalent or more secure compensating controls.

If your system, data, or traffic data is designated, meet the minimum standards, guidelines, rules, or procedures the Presidential Order prescribes, which section 7(2) requires to cover at least securing systems by default and logging system and user activity for audit, and permit the National Computer Security Incidence Response Team to audit and inspect the designated infrastructure at any time.

For a remote biometric identification system, log the start and end date and time of each use, the reference database checked, the input data that produced a match, and the identity of the person who verified the result.

Keep the logs your high-risk AI system automatically generates under Article 12, to the extent they are under your control, if you are its provider.

Keep the logs your high-risk AI system automatically generates, to the extent they are under your control, if you are its deployer.

Keep the logs the system automatically generates, to the extent they are under your control, as Article 19 requires.

Allow access only to authorised persons, and record accesses and processing operations automatically in non-modifiable log files kept for five years (art. 10, comma 8).

An owner of such a heightened-risk system must meet the Cabinet of Ministers' risk-management, transparency, accuracy, reliability, data-quality and technical-documentation requirements, keep operating logs, and declare conformity in a signed digital document published on the owner's site before the system is deployed.

A user of such a heightened-risk system must operate it per its instructions, keep the data it processes relevant, maintain effective human oversight and resourcing, immediately suspend use and notify the owner once it has grounds to believe use as instructed could cause harm to a protected interest, keep operating logs, and comply with a regulator's suspension order or a final court order to stop using the system.

Retain your systems' connection and traffic data for ten years, and submit your networks and information systems to a mandatory, periodic security audit on terms a regulation sets.

At the medium or high tier, run an automatic mechanism monitoring access to the database's systems, retained at least 24 months, and appoint a data security officer where required.

Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).

Have the European logging software component of an EHR system designed to enable access to personal electronic health data record at least, on every access event or group of events, the identification of the healthcare provider or other individuals who accessed the data, the identification of the specific natural person or persons who accessed it, the categories of data accessed, the time and date of access and the origin or origins of the data (Annex II, point 3.2).

Include in the harmonised software components tools or mechanisms to review and analyze the log data, or support the connection and use of external software for the same purposes, and support different retention periods and access rights that take into account the origins and categories of electronic health data (Annex II, points 3.3 and 3.4).

Make the product identify the software installed on it that is necessary for it to operate safely and provide that information at all times in an easily accessible form, and collect evidence of a legitimate or illegitimate intervention in that hardware component, in the software, or in a modification of the software or its configuration (section 1.1.9).

Enable a tracing log of the data generated in relation to an intervention, and of the versions of safety software uploaded after the product is placed on the market or put into service, for five years after each upload, exclusively to demonstrate conformity further to a reasoned request from a competent national authority (section 1.2.1, point (f)).

Establish, for all assets within your cybersecurity perimeter, at least the capabilities of a cybersecurity operation center (CSOC): security logs from your systems and applications, security monitoring including intrusion detection and vulnerability assessment, analysis and the actions needed to protect the entity, and participation in the information collection and sharing Article 38 describes (Article 38(1), point (a)); you may procure these through managed security service providers but remain responsible for them and supervise their efforts (Article 38(1), point (b)).

Connect all your ICT systems' clocks to the Network Time Protocol server of the National Informatics Centre or the National Physical Laboratory, or to an NTP server traceable to one of them, and ensure any other time source you use does not deviate from NPL or NIC.

Enable logs of all your ICT systems and retain them securely, within Indian jurisdiction, on a rolling 180-day basis, and provide them to CERT-In together with an incident report or when CERT-In orders or directs you to.

Record each use automatically in non-modifiable log files and keep them for five years (art. 9, comma 2).

The CBJ expects you to log and keep auditable all data, models, decisions, user prompts and authorized overrides, to store logs in a secure, tamper-evident manner, and to provide regulatory authorities with comprehensive audit reports on AI decision-making processes (sections 2.2 and 4.2).