Policy 7230A - Department of Administration

ecorded logs. In the event of other logging system failures the information system
will be configured to immediately notify appropriate administrative personnel but
take no other automated actions.
All information systems, where the information system has the capability, shall be
configured to notify appropriate administrative personnel in the event that
inappropriate, unusual and/or suspicious activity is noted. In the event that
automated notification fails, all system logs shall be manually reviewed according to a
pre-defined period of time. Should inappropriate, unusual and/or suspicious activity
be noted, it shall be fully investigated by appropriate administrative personnel and
findings reported to appropriate security management personnel.
These investigative functions will be supported by a reporting capability within the
information system itself or within an accessory auditing system should one be used.
This reporting function will have the ability to parse all collected information to
produce custom reports. In all circumstances these reports will be automatically timestamped
by the reporting system itself.
System logs are considered confidential information. As such all access to system logs
and other system audit information requires prior authorization and strict
authentication whether the logs or other system audit information resides in the
information system itself or in an accessory audit system. Further, any access to logs
or other system audit information will be captured in those logs.
On an annual basis the system audit policies and procedures will be reviewed and,
where required, updated.
25