Tools
Control Mesh
Writing
About
The Skeleton
Policy scaffold

Logging and Monitoring Policy

Determines what the organisation will be able to reconstruct after the fact, and how long it keeps the ability to do so.

What it has to decide

  1. What must be logged, by event class

    Authentication, authorisation changes, privileged actions, data access at defined classifications, and configuration change. List the classes, not the systems, so new systems inherit the requirement.

  2. Retention, split into hot and cold

    Searchable retention and archival retention are different numbers and different costs. State both. Intrusions are frequently discovered months after they begin, and a thirty day window will not reach back to the start.

  3. Integrity of the log itself

    Logs must be written where the account that generated the event cannot alter them. A privileged user who can edit the record of their own actions makes the whole exercise decorative.

  4. Clock synchronisation

    One authoritative time source, stated. Correlating across systems whose clocks disagree is the quiet reason timelines cannot be built.

  5. What is actually alerted on, and to whom

    Collection is not detection. Name the conditions that generate an alert, who receives it, and the expected response time.

  6. What must not be logged

    Credentials, card data, health information and full personal records. Logs are widely readable, and this clause prevents the logging system becoming the largest uncontrolled copy of sensitive data in the estate.

How it is usually got wrong

  • Everything is collected, nothing is alerted on, and the platform is described as a detection capability.
  • Retention is thirty days because that is the licence tier, and the average dwell time for the threats being defended against is longer.
  • Administrators can delete their own audit trail, so the record is not evidence.
  • Clocks drift across the estate and no single source is authoritative, so cross-system correlation fails.
  • Passwords and session tokens appear in application logs that half the engineering team can read.

Worked extract

What a decision looks like once it has been madeAuthentication events, changes to entitlements, all actions taken using privileged accounts, access to Restricted data, and changes to system configuration are logged. Logs are forwarded within five minutes to a central store that the originating account cannot write to, alter or delete. Logs remain searchable for ninety days and are retained in archive for eighteen months. All systems synchronise to the organisation's authoritative time source and record timestamps in UTC. Credentials, session tokens, card data and full records of personal information must not be written to logs; where a system does so, that is a defect and is raised as one. Failed privileged authentication, creation of a privileged account, and disabling of logging each raise an alert to the security operations team with a target acknowledgement of fifteen minutes.