SFS 0 / SF 4

Back to SFS 0

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are operational logs maintained on all organization-owned workstations throughout the review period to support incident investigation and monitoring?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Logs are generated, retained per policy, and used in incident investigations during the review period

Assessment criterion and evidence

Actor: Organization's IT department. Scope: All organization-owned workstations (including remote and diskless clients). Evidence period: The specified review period per audit scope. Required evidence: Workstation logging configuration documentation; Log retention policy with enforcement evidence; Incident investigation reports citing workstation logs. Negative criterion: Logs are disabled, overwritten prematurely, or lack necessary details for investigations. Missing evidence: Pending verification when no log records or policies are provided

View the JSON record (opens in a new tab).

Assessment result: unset.