10.3.1 Read access to audit logs files is limited to those with a job-related need.

Defined Approach Requirements

10.3.1 Read access to audit logs files is limited to those with a job-related need.

Customized Approach Objective

Stored activity records cannot be accessed by unauthorized personnel.

Defined Approach Testing Procedures

10.3.1 Interview system administrators and examine system configurations and privileges to verify that only individuals with a job-related need have read access to audit log files.

Purpose

Audit log files contain sensitive information, and read access to the log files must be limited only to those with a valid business need. This access includes audit log files on the originating systems as well as anywhere else they are stored.

Good Practice

Adequate protection of the audit logs includes strong access control that limits access to logs based on "need to know" only and the use of physical or network segregation to make the logs harder to find and modify.