
306 ◾ Information Security Fundamentals
Confidential Internal use Public
Logging access activity Log all access
attempts; information
owner to review all
access and violation
attempts
Log all violation
attempts; information
owner reviews as
appropriate
No special
requirements
Access report
retention
requirements
Information owner to
determine retention of
access logs (not to
exceed 1 year)
Information owner to
determine retention of
violation logs (not to
exceed 6 months)
No special
requirements
Figure 12.13 (Continued) Information-handling matrix for electronically stored
information.
By FAX Attended at receiving
FAX
Information owner to
define requirements ...