Protecting log information--sending logs to CloudWatch

For critical applications, all add, change/modify, and delete activities or transactions must generate a log entry. Each log entry should contain the following information:

1. • User identification information
   • Type of event
   • Date and time stamp
   • Success or failure indication
   • Origination of event
   • Identity or name of the affected data, system component, or resource

Protecting logs:

1. • Verify that audit trails are enabled and active for system components
   • Ensure that only individuals who have a job-related need can view audit trail files
   • Confirm that the current audit trail files are protected from unauthorized modifications via access control mechanisms, physical segregation, and/or network segregation
   • Ensure that the current audit trail files are promptly backed up to a centralized log server or media that is difficult to alter...