65 lines
2.4 KiB
Markdown
65 lines
2.4 KiB
Markdown
Title: Logging and Monitoring Policy
|
|
Document ID: [POL-LOGGING-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Logging and Monitoring Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's expectations for generating, protecting, reviewing, and using logs and monitoring data to support security and operational oversight.
|
|
|
|
## Scope
|
|
|
|
This policy applies to in-scope applications, cloud services, Kubernetes environments, endpoints, identity systems, CI/CD platforms, and security monitoring processes.
|
|
|
|
## Objectives
|
|
|
|
- support detection of security events and operational issues
|
|
- provide evidence for investigation, review, and assurance
|
|
- protect monitoring data against unauthorised access or tampering
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Logging and monitoring must be proportionate to the risk and criticality of the relevant service or system.
|
|
|
|
Security-relevant activities should be logged where feasible, including authentication events, privileged actions, administrative changes, and significant production or security events.
|
|
|
|
Logging arrangements for cloud-native and containerised services must consider distributed architectures, ephemeral workloads, and centralised analysis needs.
|
|
|
|
Logs and telemetry that may contain sensitive information must be handled and retained according to approved requirements.
|
|
|
|
Alerting and monitoring processes must support timely review and escalation of material issues.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must define monitoring expectations and oversight arrangements.
|
|
- System owners must ensure adequate logging exists for their services.
|
|
- Operational teams must review alerts and respond through defined processes.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Gaps in required logging or monitoring coverage must be tracked, risk-assessed, and remediated or formally accepted.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed through control testing, incident handling, alert tuning, audit, and management review.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Logging and Alerting Standard
|
|
- Security Incident Handling Procedure
|
|
- Incident Register Template
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|