Requirement
In addition to the subcontrols in ECC control 2-12-3, cybersecurity requirements for event logs and monitoring management for critical systems must include at least the following:
Sub-Controls
2-11-1-1
Requirement: Activating cybersecurity event logs on all technical components of critical systems.
2-11-1-2
Requirement: Activating and monitoring of alerts and event logs related to file integrity management.
2-11-1-3
Requirement: Monitoring and analyzing user behavior.
2-11-1-4
Requirement: Monitoring critical systems security events around the clock.
2-11-1-5
Requirement: Maintaining and protecting critical systems security events logs. The log shall include all details (e.g., time, date, ID and affected system).
References
- ECC – 2:2024 equivalent: 2-12-3
