Policy 7230A - Department of Administration

eviewed weekly and every system and every log entry
type should be reviewed biweekly.
7.1.3.b Log Prioritization Scheme
• Events that affect systems and/or information of greater
criticality and/or sensitivity should receive a higher
prioritization.
• Events that occur with greater frequency should receive a
higher prioritization.
• Events that can be correlated across multiple systems should
receive a higher prioritization.
• Other factors can be included in the prioritization process:
o Time of day of the event.
o Day of the week and/or month of the event.
o Source of the event.
o Newness of the event.
7.1.3.c Log Response
• Where systems are determined to be out of synchronization
with established standards, system documentation should be
checked to determine if the variance is documented and
approved. If not, the system owner is to be contacted and the
system should be restored to established standards.
• Where security attacks are determined to have occurred the
event should be considered a Security Incident and Incident
Response processes should be initiated.
• Where policy violations are determined to have occurred,
depending on the nature of the violations, various actions may
be taken:
o Policy violation sanctions may be taken.
o Incident Response processes may be triggered.
7.2. Maintain Records
Agencies should capture documentation appropriate to all systems audit processes:
• Document and retain copies of the configuration of logging capabilities for
each system.
• Document and retain copies of the results of all tests of system logging
capabilities.
• Maintain copies of all reports generated as a result of log monitoring and
analysis.
23