Habit 13 of 18
Spot problems
Sign-in logs and alerts
Sign-ins and changes are logged, and someone actually looks at the alerts.
Many breaches go unnoticed for weeks. Sign-in alerts can turn weeks into hours.
Switch it on in the map Counts towards 8 articles, controls and categories
§1 How to do it
How a small firm does it
- Turn on sign-in and audit logs in your email and main cloud services.
- Set alerts for unusual sign-ins and changes, such as new forwarding rules.
- Make sure a named person reads the alerts, and knows what to do.
- Keep logs long enough to look back after an incident, for example 90 days or more.
Evidence that shows it
- Screenshots of the alert settings
- Who receives the alerts, and an example of one being handled
Ireland: NCSC Ireland guidance on logging and monitoring applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(b) Incident handling · supports
incident handling
Handling incidents depends on spotting them. The implementing rules for incident handling include monitoring and logging (2024/2690, Annex §3.2).
Read Art 21(2)(b) on EUR-Lex
General Data Protection Regulation 1 item
-
32(1)(b) Ongoing confidentiality, integrity and resilience · supports
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
Seeing unusual sign-ins helps protect the confidentiality and integrity of systems.
Read Art 32(1)(b) on EUR-Lex
ISO/IEC 27001:2022 3 items
-
Cl 9.1 Monitoring and measurement · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
Logs give you evidence for monitoring and measuring how security is working.
About ISO/IEC 27001:2022 on ISO -
A.8.15 Keeping logs · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about producing, keeping and protecting logs.
About ISO/IEC 27001:2022 on ISO -
A.8.16 Watching for unusual activity · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about watching systems for unusual behaviour and acting on it.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 3 items
-
PR.PS Platform security · supports
PR.PS-04: Log records are generated and made available for continuous monitoring
Turning on sign-in and change logs is generating log records for monitoring.
Read PR.PS-04 on NIST -
DE.CM Continuous monitoring · supports
DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events
DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
Logs and alerts are how sign-ins and system use are monitored.
Read DE.CM-03, DE.CM-09 on NIST -
DE.AE Analysing unusual events · supports
DE.AE-02: Potentially adverse events are analyzed to better understand associated activities
DE.AE-06: Information on adverse events is provided to authorized staff and tools
Someone looking at the alerts is the start of analysing unusual events.
Read DE.AE-02, DE.AE-06 on NIST
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.