ACP 185

UNCLASSIFIED
ANNEX A TO
ACP 185
1.31 Audit Logging Procedures
1.31.1 Types of Events Recorded
All NDPKIs shall audit the system to ensure that the trust and integrity of the PKI is maintained.
This may include but not limited to certificate lifecycle operations, physical and logical access
(successful and failed) of NDPKI assets such as CAs, authorised repositories, and RA
workstations, changes to the configuration of these systems, functions performed on the audit
log, security relevant changes to the platform and PKI applications, and requests made to the
system and responses to those requests.
For each event the following minimum information shall be recorded:
• Type of event.
• Date and time of event.
• Identity of entity causing event and that of those handling it.
• The success or failure (along with reason for failure) of the event.
CSAs are not required to log requests for revocation status or the responses to those requests.
1.31.2 Frequency of Processing Log
Audit logs shall be reviewed periodically at least six times a year for anomalous and
unauthorised events in accordance with the NDPKI policies.
1.31.3 Retention Period for Audit Log
Security audit logs shall be available onsite for at least 2 months or until review, then offsite as
archive records in accordance with National Defence regulations. Audit data can only be deleted
from a system after it has been archived.
1.31.4 Protection of Audit Log
Audit data shall not be open for modification by any person or automated system process, other
than those performing the security audit function.
NDPKI system and configuration procedures shall be in place to protect the electronic audit log
system and audit information captured electronically or manually from unauthorized viewing,
modification, deletion or destruction.
Uncontrolled copy when printed
1.31.5 Audit Log Backup Procedures
Audit logs and audit summaries shall be backed up. A copy of the audit log shall be sent off-site.
1.31.6 Audit Collection System (Internal vs. External)
The audit collection system shall be in accordance with National Defence regulations.
A-25
UNCLASSIFIED