Todd,
"It depends" can cover other questions, too, like the type of log. Some
logs might become too voluminous to set any retention longer than a few
months. Some logs may be covered under relevant regulations to your
industry and function, and some may not.
"It depends" too, on whether the next system level up -- auditing -- can
suffice for documenting your logging process. Are there systems where the
organization can discard the log data and retain the audit process data
instead as your documentation?
I did a rundown some months ago for anything regulatory that may have some
type of requirement or guidance. It's specific to financial services, and
so is not all-inclusive, but it may help others. The record group is more
general than "Logs" but you can read logs into it.
(Don't know how the formatting will translate to the list email format so
take that into consideration when reading.)
Survey of Regulations & Guides for Managing Cyber Security Records
Section I. Laws and Rules
1. The Gramm-Leach Bliley Act of 1999 (GLBA)
· Purpose is the protection of consumers? personal financial
information. GLBA includes three parts: The Financial Privacy Rule, The
Safeguards Rule, and the Pretexting Provisions.
· The Safeguards Rule (16 C.F.R. 314) is the section that pertains
to this survey. It gives general requirements for financial institutions
to develop programs to protect consumer information.
2. Sarbanes-Oxley Act, 2002 (SOX)
· Purpose is to ?protect investors by improving the accuracy and
reliability of corporate disclosures??
· Section 302 requires CEO?s and CFO?s of publically traded
companies to assess and report on the effectiveness of internal controls
around financial reporting. It does not specify which or what type of
controls.
· Section 404 requires a publically traded company to assess the
effectiveness of its internal controls and report their assessment to the
SEC. It does not specify which or what type of controls.
· Several organizations have been created to assist companies with
determining which controls must be put into place and monitored and
reported on to comply with SOX. They are listed in the Guides section of
this document.
3. Health Information Portability and Accountability Act of 1996 (HIPAA)
· Purpose is to protect the privacy and security of certain health
information. It applies to PNC businesses that service healthcare
organizations and process healthcare transactions.
· HIPAA?s Security Rule, Security Standards for the Protection of
Electronic Protected Health Information, was published as a final rule on
February 20, 2003. It establishes a set of security standards for
protecting certain health information, ?while allowing covered entities to
adopt new technologies to improve the quality and efficiency of patient
care.?
· The Security Rule protects all individually identifiable health
information a covered entity, receives, maintains or transmits in
electronic form, called ?electronic protected health information.?
· Technical safeguards required by the Security Rule include Access
Control, Audit Controls, Integrity Controls, and Transmission Security.
· Policies, procedures, and documentation of actions, activities, or
assessments required by the Security Rule are required to be retained for
6 years from the date of its creation or the date when it was last in
effect (45 CFR 164.316).
4. The Health Information Technology for Economic and Clinical Health Act
(HITECH)
· ?Part of the American Recovery and Reinvestment Act of 2009, the
HITECH Act significantly modifies HIPAA by adding new requirements
concerning privacy and security for patient health information. It widens
the scope of privacy and security protections available under HIPAA,
increases the potential legal liability for non-compliance and provides
for more enforcement. ?
· It applies to health care providers, health plans, health
clearinghouses and "business associates," including people and
organizations that perform claims processing, data analysis, quality
assurance, billing, benefits management, etc.
· Records retention not prescribed.
5. Electronic Funds Transfer Act (Regulation E)
· This part applies to any electronic fund transfer that authorizes
a financial institution to debit or credit a consumer's account.
· EFTA Reg E does not specifically address retention of security or
access records. However, the section addressing resolution of errors (12
CFR 205.11) does set a time period of 90 days in which a financial
institution must complete an investigation of its internal records when a
consumer reports a suspected error in an EFT transaction. If the Cyber
Security Team determines that access logs or related security records &
would be part of the documentation needed, then affected logs & related
records should be considered to be retained for a minimum of 90 days.
6. Fair and Accurate Credit Transactions Act of 2003 (FACTA)
· The Red Flags Rule establishes new provisions within FACTA
requiring financial institutions, creditors, etc. to develop and implement
an identity theft prevention program.
· It is up to each financial institution to determine what elements
will be in its identity theft prevention program. To that end, an
organization would determine which, if any, of its records, information,
or data apply.
· FACTA does not contain any requirements specific to retention of
program development, implementation, or monitoring records.
7. Interagency Guidelines Establishing Information Security Standards
· ?The Guidelines apply to customer information maintained by or on
behalf of entities over which the OCC has authority.?
· The text of the Guidelines is the same as the GLBA Safeguard Rule.
Identical sets of Guidelines are published separately under the following
regulatory agencies: 12 C.F.R. part 30, app. B (OCC); 12 C.F.R. part 208,
app. D-2 and Part 225, app. F (FRB); 12 C.F.R. part 364, app. B (FDIC); 12
C.F.R. part 570, app. B (OTS); 12 C.F.R. part 748, appendix A (NCUA); and
16 C.F.R. 314 (FTC). Implementing these guidelines apparently satisfies
the information security requirements of GLBA, FACTA, and related
regulations: These guidelines ?set forth standards pursuant to section 39
of the Federal Deposit Insurance Act (section 39, codified at 12 U.S.C.
1831p?1), and sections 501 and 505(b), codified at 15 U.S.C. 6801 and
6805(b) of the Gramm-Leach Bliley Act. These Guidelines also address
standards with respect to the proper disposal of consumer information,
pursuant to sections 621 and 628 of the Fair Credit Reporting Act (15
U.S.C. 1681s and 1681w).?
· The Guidelines provide high-level, general requirements only. They
do not specify retention of records of security program development,
implementation, or monitoring.
· Original deadline of program implementation: July 1, 2001.
Section II. Standards and Guides
1. SOX Guidance
· Public Company Accounting Oversight Board (PCAOB) ? created by the
Act to oversee and guide auditors who assess a company?s compliance with
SOX. Publishes Proposed Auditing Standards for assessing compliance. A
2004 Standard states that internal controls assessment should include
information technology general controls. It does not specify any specific
information technology controls.
· Committee of Sponsoring Organizations of the Treadway Commission
(COSO) ? A framework of internal controls guidance approved by the PCAOB.
The COSO framework is not required for SOX compliance, but using it or
something similar is considered to be an effective program for compliance.
COSO includes general guidance on information security controls, control
environment, risk assessment, control activities, and information &
communication, and monitoring.
· Control Objectives for Information and Related Technology (COBIT)
? A framework created for more specific guidance for creating and
assessing Technology controls. The COBIT framework addresses 34
Technology processes from strategic planning to implementation, production
support, and monitoring, grouped into four categories
1. Planning & Organization
2. Acquisition & Implementation
3. Delivery & Support
4. Monitoring
· Information Technology Governance Institute (ITGI) ? Used COSO and
COBIT to create a set of specific Technology control objectives for SOX.
The ITGI general control objectives address security, and break security
down into sub-topics:
1. Security Policy
2. Security Standards
3. Access and Authentication
4. Network Security
5. Monitoring
6. Segregation of Duties
7. Physical Security
2. Payment Card Industry Data Security Standard (PCI DSS)
Developed by the Security Standards Council, its purpose is to ?encourage
and enhance cardholder data security and facilitate the broad adoption of
consistent data security measures globally.?
Records Retention recommendations in the Standard:
· Requirement 9: Restrict physical access to cardholder data.
· 9.4 Retain visitor logs for 3 months.
· Requirement 10: Track and monitor all access to network resources
and cardholder data.
· 10.7 Retain audit trail history for at least one year, with a
minimum of three months immediately available for analysis (for example,
online, archived, or restorable from back up).
3. NIST SP 800-66 An Introductory Resource Guide for Implementing the
Health Insurance Portability and Accountability Act (HIPAA) Security Rule.
· Developed for use by federal agencies, it may also be used by
nongovernmental organizations on a voluntary basis. It is not a statute or
rule, nor a requirement for non-federal organizations.
· Section 4 addresses safeguards, including access and audit
controls.
· Section 4.22 sets a six year retention for documentation of
policies, procedures, actions, activities or assessments required by the
HIPAA Security Rule.
4. NIST Special Publications Series 800 ? Computer Security
· ?Special Publications in the 800 series present documents of
general interest to the computer security community. The Special
Publication 800 series was established in 1990 to provide a separate
identity for information technology security publications. This Special
Publication 800 series reports on ITL's research, guidelines, and outreach
efforts in computer security, and its collaborative activities with
industry, government, and academic organizations.?
· Though none deal exclusively with managing security records, some
address topics that touch on issues that are shared with the records
management space, for examples NIST SP 800-88 Guide to Computer Security
Log Management, and NIST SP 800-88 Guidelines for Media Sanitation.
Gary Link
Pittsburgh, PA
[log in to unmask]
The contents of this email are the property of PNC. If it was not addressed to you, you have no legal right to read it. If you think you received it in error, please notify the sender. Do not forward or copy without permission of the sender. This message may contain an advertisement of a product or service and thus may constitute a commercial electronic mail message under US Law. The postal address for PNC is 249 Fifth Avenue, Pittsburgh, PA 15222. If you do not wish to receive any additional advertising or promotional messages from PNC at this e-mail address, click here to unsubscribe: http://pages.e.pnc.com/globalunsub/
By unsubscribing to this message, you will be unsubscribed from all advertising or promotional messages from PNC. Removing your e-mail address from this mailing list will not affect your subscription to alerts, e-newsletters or account servicing e-mails.
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]
|