What to Provide
A screenshot demonstrating all users with privileged access to production log data or the production log management tool.
Evidence Format
Screenshots or exported images in a common image file type such as .jpg, .png, or .pdf.
Additional Guidance
The evidence should demonstrate all users that can:
Create, modify, or delete logging rules
Modify or delete log data
Grant access to your log management tool
NOTE: If access to the log management tool is governed via the CSP console, please (1) note in the "Evidence Description" section of the ER all of the specific groups/role permissions that would provide a user privileged access to the log management tool through the CSP console authentication mechanism, and (2) provide a screenshot of all users assigned to the associated groups/role permissions that would provide privileged access to the log management tool.
Related Articles
Associated Unified Control ID | Associated Framework Control |
CTRL-9 | LCL-32 |