This appendix identifies required and recommended logging elements and events for High Impact Systems under Section 6.A.II.
Required Log Elements (Must)
All required logs must include, at a minimum:
- User or system identifier
- Date and time
- Event type
- Success or failure status, where applicable
- Source of the event, such as IP address, device, or location
Authentication Events (Must)
The following authentication-related events must be logged:
- Successful and failed authentication attempts
- User logon and logoff activities
- Password, credential, or authentication changes
Account Lifecycle Activities (Must)
The following account management events must be logged:
- Account creation
- Account modification
- Account disabling
- Account deletion
- Changes to account roles, permissions, or access rights
Privileged and Administrative Activity (Must)
The following events must be logged:
- Use of privileged, administrative, or elevated accounts
- Administrative or security-sensitive activities
- Changes to privileged group memberships
- Assignment or removal of privileged access
Security Configuration Changes (Must)
The following events must be logged:
- Security policy changes
- Security-relevant configuration changes
- Changes to logging configurations
- Changes to authentication or access-control settings
System and Security Events (Should)
The following events should be logged where they support detection, investigation, or response activities:
- System start/stop events
- System and network alerts, warnings, or error messages
- Execution of administrative scripts, scheduled tasks, or automated processes
File and Data Access Events (Should):
The following should be logged:
- Creation, modification, or deletion of system files
- Creation, modification, or deletion of sensitive data
- Access to files or datasets containing high risk data