Policy 7230A - Department of Administration

and systems should be afforded appropriate protection based
on this risk classification.
7.1.1.c Log Failure
• If system logging fails because on-line storage is filled, the
system should issue an alert to appropriate administrative
staff and begin overwriting logs, starting with the oldest online
log information.
• If system logging fails for any other reason, the information
system should issue an alert to appropriate administrative
staff but take no other actions.
7.1.2. Test Auditing Capabilities
Agencies should periodic audit capability testing to ensure that auditing
capabilities continue to operate as intended:
7.1.2.a Audit Testing Methodologies
• On-line log storage should be artificially filled to just below
capacity and the system allowed to process activity until
capacity is reached to observe whether an automatic transfer
to off-line storage occurs and whether automatic log overwrite
begins.
• Log functionality should be artificially halted and the system
allowed to continue operations to observe whether processing
continues or is halted.
7.1.2.b Audit Testing Scheduling and Frequency
• Audit testing should be performed on an at least annual basis.
7.1.3. Operate Auditing Capabilities
Agencies should analyze the information generated by these auditing
capabilities on an ongoing basis to ensure systems are being operated in the
appropriate manner and that security is being maintained:
7.1.3.a Log Review Scheduling and Frequency
• Where sufficient resources exist, all logs generated for all
information systems should be reviewed daily.
• Where sufficient resources for full log review do not exist
partial random log review should be performed:
o A randomly determined subset of all systems should be
reviewed.
o A randomly determined subset of all log entries should
be reviewed.
o Random review should be structured such that either
every system or every log entry type should be
22