Initial commit

01-policies/logging-and-monitoring-policy.md

@@ -0,0 +1,64 @@
+Title: Logging and Monitoring Policy
+Document ID: [POL-LOGGING-001]
+Version: 0.1 Draft
+Status: Draft
+Owner: CISO (Paul Jenkins)
+Approver: CEO (Paul Hague)
+Classification: Internal
+Effective date: [DD Month YYYY]
+Review date: [DD Month YYYY]
+
+# Logging and Monitoring Policy
+
+## Purpose
+
+This policy defines BlackDice's expectations for generating, protecting, reviewing, and using logs and monitoring data to support security and operational oversight.
+
+## Scope
+
+This policy applies to in-scope applications, cloud services, Kubernetes environments, endpoints, identity systems, CI/CD platforms, and security monitoring processes.
+
+## Objectives
+
+- support detection of security events and operational issues
+- provide evidence for investigation, review, and assurance
+- protect monitoring data against unauthorised access or tampering
+
+## Principles / Policy Statements
+
+Logging and monitoring must be proportionate to the risk and criticality of the relevant service or system.
+
+Security-relevant activities should be logged where feasible, including authentication events, privileged actions, administrative changes, and significant production or security events.
+
+Logging arrangements for cloud-native and containerised services must consider distributed architectures, ephemeral workloads, and centralised analysis needs.
+
+Logs and telemetry that may contain sensitive information must be handled and retained according to approved requirements.
+
+Alerting and monitoring processes must support timely review and escalation of material issues.
+
+## Roles and Responsibilities
+
+- [Role] must define monitoring expectations and oversight arrangements.
+- System owners must ensure adequate logging exists for their services.
+- Operational teams must review alerts and respond through defined processes.
+
+## Compliance / Exceptions
+
+Gaps in required logging or monitoring coverage must be tracked, risk-assessed, and remediated or formally accepted.
+
+## Monitoring and Review
+
+This policy should be reviewed through control testing, incident handling, alert tuning, audit, and management review.
+
+## Related Documents
+
+- Information Security Policy
+- Logging and Alerting Standard
+- Security Incident Handling Procedure
+- Incident Register Template
+
+## Version Control
+
+| Version | Date | Description of Change | Author |
+| --- | --- | --- | --- |
+| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |