Requirement
In addition to subcontrols in the ECC control 2-12-3, the CSP shall cover the following additional subcontrols for cybersecurity requirements for cybersecurity event logs and monitoring management, as a minimum:
Sub-Controls
2-11-P-1-1
Requirement: Activating and protecting event logs and audit trails of Cloud Technology Stack.
2-11-P-1-2
Requirement: Activating and collecting login attempts history.
2-11-P-1-3
Requirement: Activating and protecting all event logs of activities and operations performed by the CSP at the tenant level in order to support forensic analysis.
2-11-P-1-4
Requirement: Protecting cybersecurity event logs from alteration, disclosure, destruction and unauthorized access and unauthorized release, in accordance with regulatory, or law requirements.
2-11-P-1-5
Requirement: Continuous cybersecurity events monitoring using SIEM technique covering the full Cloud Technology Stack.
2-11-P-1-6
Requirement: Reviewing cybersecurity event logs and audit trails periodically, covering CSP events in the Cloud Technology Stack.
2-11-P-1-7
Requirement: Automated monitoring and logging of remote access sessions event logs.
2-11-P-1-8
Requirement: Secure handling of user-related data found in the audit trails and the cybersecurity event logs.
References
- ECC – 2:2024 equivalent: 2-12-3
