SFS 4 / SF 9

Back to SFS 4

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are access logs for sensitive organization-owned data maintained with sufficient detail to support audit trails throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Complete access logs with user identities, timestamps, data accessed, and actions recorded

Assessment criterion and evidence

Actor: Organization. Scope: Sensitive organization-owned data access activities across storage systems. Evidence period: Review period. Required evidence: Configured logging specifications for data access systems; Sample audit trail records demonstrating required fields. Negative criterion: Missing logs, incomplete fields, or insufficient detail to reconstruct access events. Missing evidence: Pending validation pending evidence submission

View the JSON record (opens in a new tab).

Assessment result: unset.