Organizational Security Policy

Policy is the First Step in Implementing Cybersecurity

Audit and Accountability

POL.AU.L2-3.3.1

All systems that store, process, or transmit CUI shall create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. Audit logs shall be retained for 90 days.

POL.AU.L2-3.3.2

All systems that store, process, or transmit CUI shall provide non-repudiation to ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

POL.AU.L2-3.3.3

All systems that store, process, or transmit CUI logged events shall be reviewed at least daily by Planet Security, Inc. engineers and findings followed up on until an acceptable due care effort has been performed.

POL.AU.L2-3.3.4

All systems that store, process, or transmit CUI shall shall alert Planet Security, Inc. administrators in the event of an audit logging process failure.

POL.AU.L2-3.3.5

All systems that store, process, or transmit CUI shall transmit log data to the Planet Security, inc. Security Information Event Management (SIEM) tool whereby it may be processed to correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

POL.AU.L2-3.3.6

All systems that store, process, or transmit CUI shall transmit log data to the Planet Security, inc. Security Information Event Management (SIEM) tool whereby audit record reduction and report generation to support on-demand analysis and reporting may be achieved.

POL.AU.L2-3.3.7

All systems that store, process, or transmit CUI shall provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

POL.AU.L2-3.3.8

Audit information and audit logging tools shall be accessible only to Planet Security, Inc. engineers.

POL.AU.L2-3.3.9

Audit logging functionality shall only be made accessible to Planet Security, Inc. engineers who are assigned to support the respective CLIENT organization.

For questions regarding this Information Security Policy, please reach out to your Planet Security, Inc. Support Engineers using Signal.