Järjestelmälokien kehityksen tulee pysyä järjestemän kehityksen mukana ja mahdollistaa esim. tarvittava häriötilanteiden selvitys. Kuvaamme tietojärjestelmälistauksen yhteydessä, minkä järjestelmien suhteen vastuu lokituksen toteutuksesta on itsellämme. Näiden järjestelmien suhteen dokumentoimme:

• mitä tietoja lokiin tallentuu
• kuinka pitkään lokin tiedot säilytetään

The processing of classification level II–III information must be recorded in an electronic log, information system, case register, or in the information itself (for example, as part of the document). On this topic, there is a recommendation VM 2021:5: Recommendation on the handling of classified documents.

In processing environments of classification levels III and II, the requirement can be met by implementing the following measures:

• clear instructions are provided to relevant personnel regarding the collection, disclosure, and monitoring of log data
• key records are retained for at least 5 years, unless legislation, recommendations, or agreements require a longer retention period; records with very limited significance, for example in the investigation of incidents or in criminal proceedings, may be retained for a shorter period, such as 2-5 years
• log data is regularly backed up
• the clocks of essential information processing systems within the same security area are synchronized with an agreed time source
• there is a method for ensuring the integrity (immutability) of logs
• the use and handling of generated log data are themselves recorded.

In the processing of classification level I information, it is recommended on a risk basis that log data be retained for longer periods than for classification level II information (for example, at least 10 years).

Information processing environments for classification level I are typically limited in scope, consisting for example of terminal devices permanently disconnected from all networks. However, the reliable retention of a 10-year log accumulation is difficult to achieve using only terminal devices. Therefore, the collection of logs from such devices and the backup of collected log data usually require a planned and regular process. A practical implementation may be the regular collection of log data onto removable media, which is handled and stored for as long as classification level I information itself.

It must also be noted that if system access control or, for example, traceability relies on physical security measures, the records created by such measures may also need to be retained and managed in accordance with classification level I procedures.

• There is a procedure for detecting anomalies from collected records and situational data (for example, changes in log accumulations), with a particular requirement to detect unauthorized attempts to access the information system
• there is a procedure for detecting anomalies in information processing environment hosts (e. g. workstations and servers)
• there is a procedure for recovery from detected anomalies.

Organisaation on oltava selvillä eri tietojärjestelmien käytöstä kertyvistä tapahtumalokeista, olipa lokien tuottaminen omalla tai järjestelmätoimittajan vastuulla. Lokeihin tallentuvat käyttäjien suorittamat toiminnot sekä tapahtuneet poikkeamat, virheet ja tietoturvatapahtumat.

Kertyvän lokin riittävyyttä on katselmoitava säännöllisesti. Lokin avulla pitäisi tarvittaessa pystyä selvittämään järjestelmään liittyvät häiriötilanteet ja niiden syy.