PR.PS-04.250
Are all operating systems, applications, and services (including cloud-based services) configured to generate appropriate log records?
Explanation
Log generation is a fundamental security control that provides visibility into system activities, user actions, and potential security incidents. Without proper logging configured across all systems, it becomes extremely difficult to detect unauthorized access, investigate security incidents, or maintain an audit trail for compliance purposes.
Evidence of fulfillment could include a logging configuration standard document, screenshots of logging settings from representative systems, or output from an automated configuration management tool showing logging parameters across the environment.
Implementation Example
Configure all operating systems, applications, and services (including cloud-based services) to generate log records
ID: PR.PS-04.250
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Log records are generated and made available for continuous monitoring
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
