Audit and accountability

// REQUIREMENTS

// INTENT

When something happens, you can reconstruct it.

// WHAT A FIRST ASSESSMENT FINDS

Logs exist wherever vendors defaulted them on, retained until the disk fills, reviewed never.

// THE WORK

Decide which events matter (authentication, privilege use, access to the enclave, changes to security configuration), aggregate them somewhere central even if it's a modest syslog box, retain them for a defined period, protect them from tampering, and review them on a schedule a human keeps. An assessor asking for last Tuesday needs to get last Tuesday.

// HOW WE CAN INTERPRET IT

// TEMPLATES FOR THIS FAMILY

• Policy inventory checklist
• Shared responsibility matrix