UW System Administrative Policy 1041

Information Security: Logging and Monitoring

Original Issuance Date: June 9, 2021
Last Revision Date: September 29, 2026

1.  Policy Purpose

The purpose of this policy is to establish consistent security logging and monitoring practices across the Universities of Wisconsin (UW) to aid in the early identification and forensic investigation of security events.

2. Responsible UW System Officer

Associate Vice President for Information Security

3. Scope and Institutional Responsibilities

This policy applies to all UW institutions, including UW Administration, and to all UW-owned or leased IT assets. Specific requirements within this policy may apply based on the risk, impact, function, or technical capabilities of the asset. Institutions are responsible for determining applicability and implementing the requirements of this policy.

4. Background

The President of the Universities of Wisconsin is empowered to establish information security polices under Regent Policy Document 25-5, Information Technology: Information Security. The UW is committed to a secure information technology environment in support of its mission.

Without appropriate security logging and monitoring, malicious activity may go undetected, and logs needed to investigate security events may be unavailable. Consistent logging and monitoring support the timely identification and investigation of security events and may help prevent incidents or reduce their impact.

5. Definitions

Please see SYS 1000, Information Security: General Terms and Definitions, for a list of general terms and definitions. Terms and definitions found within this policy include:

  • High Impact System
  • IT Asset

6.  Policy Statement

A. Required Logging Activities

  1. UW-owned or leased IT assets capable of generating security-relevant logs must have logging enabled. Where supported, logging sources must synchronize to a common and authoritative time source.
  2. High Impact Systems

Institutions should use the SYS 1000 Guidance: Guidance for Identifying High Impact Systems when determining whether a system meets the definition of a High Impact System.

    1. Institutions must implement mechanisms to detect and alert on failures affecting log collection, transmission, processing, or storage. Alerts should be generated as close to real time as practical.
    2. At a minimum, logging for High Impact Systems must capture the following activities, with specific logging elements and event requirements provided in Appendix A: Logging Elements and Events:
      1. Authentication activities
      2. Account lifecycle activities
      3. Privileged, administrative, or security-sensitive activities
      4. Security-relevant configuration changes

B. Log Management and Protection

Security logs must be managed and remain accessible to authorized personnel in a manner that supports security monitoring, investigation, audit, and incident response activities.

Security logs for High Impact Systems must be centrally managed. Exceptions must be documented based on technical or operational limitations.

Institutions must implement safeguards to protect logs from unauthorized access, modification, or deletion and preserve log integrity throughout the log lifecycle. Safeguards should include immutable, append-only, read-only, or equivalent protections, as appropriate to the technology and logging solution.

C. Required Monitoring Activities

  1. Institutions must develop and implement processes to review logs for systems identified as requiring active monitoring to detect anomalies or suspicious activity.
  2. Where practical, institutions should establish security baselines and use automated monitoring tools to generate alerts when deviations are detected.
  3. Systems monitored through a centralized logging service are not required to be monitored locally for the same activity.

D. Authorized Personnel

  1. Access to security logs and log management systems must be limited to individuals whose access is required to perform their job responsibilities.
  2. Access to log management systems must be recorded.

E. Retention

  1. Security logs must be retained and remain readily available for security monitoring, investigation, and incident response activities for a minimum of 30 days.
  2. Institutions must maintain sufficient storage capacity to meet logging and retention requirements and account for reasonably expected increases in log volume resulting from operational events, system changes, or security incidents.
  3. Security logs must be retained in accordance with the UW System Records Retention Schedule, where applicable.

7. Related Documents

Regent Policy Document 25-5, Information Technology: Information Security
UW System Information Security Program
NIST SP 800-92 Guide to Computer Security Log Management
SYS 1000 Guidance: Guidance for Identifying High Impact Systems
UW System Records Retention Schedule
SYS 1041 Appendix A: Logging Elements and Events

8. Policy History

Revision 2: September 29, 2026
Revision 1: March 8, 2022
First approved: June 9, 2021

9. Scheduled Review

September 2031