[Autogenerated] requirement 10.
It's all about the ability to detect and investigate incidents.
It's commonly thought of us the logging and monitoring requirement.
It's quite a long requirement for something so simple and
starts off with the basic requirement to have audit trails or
logs tied to individual use activity.
Then the standard is quite prescriptive about the systems and
events that should be logged on the level of detail that has to
be logged because log correlation, needs or systems degree in what time is.
There is a requirement for time synchronization and time
servers and also the audit log files error secure from
tampering and retained for a year.
Unsurprisingly,
the standard also wants to be to respond to events that you notice in the logs.
And as with all of the PC IDE CSS requirement,
you need to have policies and procedures to support the requirements.
Finally, there's a requirement that just applies to service providers,
which is to respond to failures of critical security systems
such as firewalls or anti malware protection.
In terms of the scope of this requirement,
every system in and connected to the 500 potentially needs to be able to
generate audit logs and synchronized to the correct time.
The requirement starts off quite simply with Requirement 10.1,
which wants to make sure that the audit trail links
people to activity on systems.
We'll see soon that in 10.2 Standard then specifies what sort of
access has to be recorded and 10.3 tells us what events
associated with activity should be logged.
But to start off the requirement is simply the audit trails link individual
user accounts to system component access and QoS A will look at system
configurations to make sure that the user IDE or name is associated with all
the events on they will also talk with system admin is to make sure this is
standard practice across all systems.