Information Security Handbook

Auditing and accountability policy

Auditing and accountability policies establish the rules for how an information system securely alerts, records, stores, and allows access to auditable events important to information security. This policy also provides rules around audit log management that allow the high volume of audit logs that an information system produces to be manageable by the information security professional.

An auditing and accountability policy should address:

• Creating, protecting, and retaining information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity
• Ensuring that the actions of individual information ...