DE.AE-06.300
Do incident responders and authorized personnel have 24/7 access to log analysis findings?
Explanation
This question assesses whether your organization provides continuous access to log analysis results for incident response team members and other authorized staff. Continuous access to log data is critical during security incidents when timely analysis can significantly reduce response time and limit potential damage. Without immediate access to these findings, incident responders may be unable to effectively investigate and mitigate security events, especially those occurring outside business hours. Evidence could include screenshots of log analysis dashboards with timestamps showing 24/7 availability, documentation of access control policies for log analysis systems, or records showing successful after-hours access to log analysis platforms by incident response team members.
Implementation Example
Incident responders and other authorized personnel can access log analysis findings at all times
ID: DE.AE-06.300
Context
- Function
- DE: DETECT
- Category
- DE.AE: Adverse Event Analysis
- Sub-Category
- Information on adverse events is provided to authorized staff and tools

