Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p20
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 20/21)
Character Range: 83814–86721

a mitigation strategy specified in subrule (1) if the most recent report of an assessor conducting a protective security assessment for the accredited entity includes the assessor's opinion that the strategy is not relevant to the entity because of the entity's particular circumstances.
Note: See rule 3.5 about an assessor's opinion that a control or strategy is not relevant to an entity.
Example: A control about Configure Microsoft Office macro settings to block macros from the internet, and only allow vetted macros either in 'trusted locations' with limited write access or digitally signed with a trusted certificate, will not be relevant to an entity if the entity does not use Microsoft products within its DI data environment.

4.20  Logging requirements
 (1) Any information technology system through which an accredited entity provides accredited services must generate logs that record activities, exceptions, faults and events in the entity's DI data environment.
 (2) Without limiting subrule (1), the activities to be recorded must include:
 (a) any creation, update, use, disclosure or destruction of personal information;
 (b) if biometric information is collected or retained by or on behalf of an ISP—the destruction of that biometric information;
 (c) successful or failed elevation of access privileges by personnel;
 (d) additions, deletions or modifications to personnel or group permissions;
 (e) system alerts or failures related to cyber security risks; and
 (f) unauthorised attempts to access critical systems or files.

Logging implementation and monitoring plan
 (3) An accredited entity must have, maintain and comply with a plan (logging implementation and monitoring plan) that details:
 (a) how the entity generates, stores, protects, monitors and analyses logs; and
 (b) how the entity monitors logs to identify any anomalous behaviour.
 (4) The logging implementation and monitoring plan must be appropriate and adapted to manage cyber security risks to the entity's accredited services and DI data environment.
Note:  If an accredited entity implements ISO/IEC 27001, subrules (1), (3) and (4) would be met by the entity complying with clauses 8.15, 8.16 and 8.17 of Annex A of ISO/IEC 27001.
 (5) Each log required to be generated by this rule must include the following details for each event:
 (a) interaction type;
 (b) transaction audit identifier;
 (c) the names of any entities involved in the event;
 (d) any unique identifier used in the event;
 (e) the date and time of the event;
 (f) for an IXP—each kind of attribute conveyed for the event;
 (g) for accredited entities other than an IXP—the types of attributes requested and disclosed to each entity involved in the event; and
 (h) if the interaction type requires express consent, the audit log for that interaction must include the following as relevant to the interaction:
 (i) the date and method by