craftvia/seed/isms-vorlagenpaket-v2-en/verfahren/VA-13_Logging-und-Monitoring-Verfahren.md

Logging and Monitoring Procedure

Document information	Value
Document type	Procedure instruction (VA-13)
Scope	{{ISMS_SCOPE}}
Organisation	{{ORG_NAME}}
Process owner	{{ROLE_IT_LEAD}}
Approved by	{{ROLE_ISB}}
Version	{{DOC_VERSION}}
Date	{{DOC_DATE}}
Status	{{DOC_STATUS}}

1. Purpose

This procedure governs the collection, protection, evaluation and retention of security-relevant log data. It operationalises the associated policy ({{LINK:R10}}).

2. Scope

Applies within the ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).

3. Trigger

Continuous operations; security-relevant event; alert from {{TECH_SIEM}}.

4. Inputs

• Log sources/systems
• Retention requirements (BL-OPS-04)
• Alerting rules

5. Process

1. Connect log sources and record centrally in {{TECH_SIEM}} (BL-OPS-04).
2. Ensure tamper protection & retention {{LOG_RETENTION}}.
3. Evaluation & alerting: maintain rules, check anomalies.
4. Hand over suspected cases to incident response (VA-01).
5. Regular review of coverage and rules.

6. RACI

#	Step	R (Execution)	A (Accountable)	C (Consulted)	I (Informed)
1	Connect log sources and record centrally in {{TECH_SIEM}}	{{ROLE_IT_LEAD}}	{{ROLE_IT_LEAD}}	-	-
2	Tamper protection & retention {{LOG_RETENTION}}	{{ROLE_IT_LEAD}}	{{ROLE_ISB}}	-	-
3	Evaluation & alerting	{{ROLE_IT_LEAD}}	{{ROLE_ISB}}	-	-
4	Hand over suspected cases to incident response (VA-01)	{{ROLE_IT_LEAD}}	{{ROLE_ISB}}	-	-
5	Regular review of coverage and rules	{{ROLE_IT_LEAD}}	{{ROLE_ISB}}	-	-

7. Result & evidence

Central, protected logging with evaluation; evidence in the ISMS tool ({{TOOL_NAME}}). Evidence is referenced in the central evidence register ({{LINK:NACHWEISREGISTER}}).

8. Key performance indicators (KPI)

• Log source coverage
• Mean time to alert response
• Share of evaluable events

9. Related documents

• Associated policy: {{LINK:R10}}
• {{LINK:VA-01}}
• Technical security baseline: {{LINK:BASELINE}}
• ISA mapping matrix: {{LINK:ISA_MAPPING}}