检测 (DE) · 主题
日志与审计
收集、关联并留存审计日志。
日志与审计由以下 NIST CSF 2.0 成果定义：PR.PS-04 (Log records are generated and made available for continuous monitoring); DE.AE-03 (Information is correlated from multiple sources)。 对照映射 通过 ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2, Essential Eight 和 DORA 中经编辑映射。 本站数据中无映射 本站数据中 GDPR, CPS 234 和 Cyber Essentials 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-04DE.AE-03 | Log records are generated and made available for continuous monitoring; Information is correlated from multiple sources | 主题定义 | PR.PS-04 DE.AE-03 |
| ISO 27001 | A.8.15A.8.17 | Logging; Clock synchronization | 对照映射 | A.8.15: via PR.PS-04; DE.AE-03; NIST 800-53 map: AU-2, AU-3, AU-11, AU-12 A.8.17: via PR.PS-04 |
| CIS v8.1 | CIS 8.2CIS 8.10CIS 3.14CIS 8.1CIS 8.3CIS 8.4CIS 8.5CIS 8.7CIS 8.8CIS 8.12 | Collect Audit Logs; Retain Audit Logs; Log Sensitive Data Access… | 对照映射 | CIS 8.2: via PR.PS-04 CIS 8.10: Retain audit logs; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 3.14: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): log access to sensitive data. CIS 8.1: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): an audit log management process. CIS 8.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): enough audit log storage. CIS 8.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): standardised time synchronisation for logs. CIS 8.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): detailed audit logs for sensitive assets. CIS 8.7: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): URL request logs. CIS 8.8: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): command-line audit logs. CIS 8.12: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): logs from service providers. |
| SOC 2 | CC7.2 | Monitoring system components for anomalies | 编辑说明 | CC7.2: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 10.2.110.3.210.5.110.6.1 | Audit logs enabled and active; Logs protected from modification; Audit logs retained 12 months, three immediately available… | 对照映射 | 10.2.1: via PR.PS-04; DE.AE-03 10.3.2: via PR.PS-04 10.5.1: Audit log retention (12 months); omitted from NIST's PCI references. 10.6.1: via PR.PS-04 |
| CMMC | AU.L2-3.3.1AU.L2-3.3.2AU.L2-3.3.7 | System Auditing; User Accountability; Authoritative Time Source | 对照映射 | AU.L2-3.3.1: via 800-171r3 03.03.01 → AU-2; 800-171r2 Appendix D → AU-2, AU-3, AU-11, AU-12 AU.L2-3.3.2: via 800-171r3 03.03.02 ↔ PR.PS-04 → AU-3; 800-171r2 Appendix D → AU-2, AU-3, AU-11, AU-12 AU.L2-3.3.7: Authoritative time source for audit records (the counterpart of ISO A.8.17); not linked to these subcategories. |
| 800-53 | AU-2AU-3AU-11AU-12 | Event Logging; Content of Audit Records; Audit Record Retention… | 对照映射 | AU-2: via PR.PS-04 AU-3: via PR.PS-04 AU-11: via PR.PS-04 AU-12: via PR.PS-04 |
| HIPAA | §164.312(b) | Audit Controls | 对照映射 | §164.312(b): via NIST HIPAA map: AU-2, AU-3 |
| GDPR | — | 无要求 | 本站数据中无映射 | 本站数据中没有 GDPR 要求映射到此主题。 |
| NIS2 | 3.2 | Monitoring and logging | 对照映射 | 3.2: via ENISA ISO map: A.8.15, A.8.17 |
| Essential Eight | ISM-1815ISM-1660ISM-1509ISM-1683ISM-1623 | Event logs are protected from unauthorised modification and deletion; Allowed and blocked application control events are centrally logged; Privileged access events are centrally logged… | 编辑说明 | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.10(3) | Detection | 编辑说明 | Art.10(3): Monitoring user activity and anomalies depends on logging; the regulation's own text doesn't set log contents or retention. |
| CPS 234 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CPS 234 要求映射到此主题。 |
| Cyber Essentials | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Cyber Essentials 要求映射到此主题。 |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于日志与审计
日志与审计控制用于确保安全相关事件被完整记录、安全存储，并可用于调查取证和合规目的。组织应记录身份验证事件、权限提升、系统变更、数据访问和网络连接，并根据自身义务要求留存日志时长；例如，PCI DSS要求保留12个月的审计日志历史记录，其中最近3个月的日志须可立即调取（10.5.1）。必须通过集中式收集、防篡改存储以及所有系统之间的时间同步来保护日志完整性，以确保在取证调查期间能够准确关联事件。