Appendix S1 Minimum Logging Requirements 4.17.26.v.26.1.docx
DOCX document 24 KB Posted
- Attached to
- WIC/Seniors FMNP E-Solution RFP
- Solicitation number
- 26-444DHS-MIS44-B-52482
- Issued by
- Illinois
About this file
This is an Appendix document containing minimum logging requirements for the State of Illinois Department of Human Services' WIC/Seniors FMNP E-Solution contract. The document establishes comprehensive logging standards that the electronic solution provider must implement across all system operations. The logging requirements encompass input and output validation events, authentication and access control activities, system and application events, privileged and administrative activities, data access and high-risk operations, and legal and consent events. All logs must include accurate timestamps synchronized to reliable time sources, be protected against unauthorized modification or deletion, and contain sufficient detail for event reconstruction including user or service account identification, session identification, source IP address, event type, resource accessed, and action taken.
The document further mandates that logs be retained in accordance with the State's Enterprise Security Policies and applicable laws or regulations, with archived logs remaining accessible to the State upon request. The State of Illinois reserves the right to access logs for audits, investigations, and security reviews, and the system must support secure log forwarding to the State's Security Information and Event Management (SIEM) infrastructure when required. These requirements apply to the electronic solution developed for processing issuance, redemption, and payment disbursements under both the Senior Farmers' Market Nutrition Program (SFMNP) and the WIC Farmers' Market Nutrition Program (FMNP).
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix S1 — Minimum Logging Requirements
1. Input and Output Validation Events
1.1 The system shall log all input validation failures, including protocol violations, unacceptable encodings, malformed data, and invalid or out-of-range parameters.
1.2 The system shall log all output validation failures, including unexpected data structures, encoding mismatches, data type errors, or inconsistent record sets.
2. Authentication and Access Control
2.1 The system shall log all authentication attempts, including successes, failures, account lockouts, MFA challenges, and MFA failures.
2.2 The system shall log all authorization failures (ie. failed MFA, wrong password, account lockout, account disabled, etc.) and denied access attempts to protected resources or functions.
2.3 The system shall log all session management events, including session creation, termination, timeout, token anomalies, and any modification of session identifiers.
2.4 The system shall log all password reset actions including, but not limited to reset requests, reset completions, and failed reset attempts.
2.5 The system shall log all security related profile changes including, but not limited to MFA device added or remove, update to MFA type, MFA reset actions, and MFA type addition or change.
3. System and Application Events
3.1 The system shall log all application errors and exceptions, including syntax, logic, runtime, and unhandled errors.
3.2 The system shall log connectivity issues, third-party service failures, and file system errors.
3.3 The system shall log all virus or malware detections, blocked file uploads, and quarantine actions.
3.4 The system shall log all configuration changes to system, application, or security settings.
3.5 The system shall log all system and application startup, shutdown, restart, and logging service initialization events (start, stop, or pause).
4. Privileged and Administrative Activity
4.1 The system shall log all use of administrative or elevated privileges.
4.2 The system shall log the creation, modification, disabling, or deletion of user accounts or groups.
4.3 The system shall log changes to privileges, roles, tokens, access rights, or identity mappings.
4.4 The system shall log the use of system-level administrative functions, command execution, and high-risk application actions.
4.5 The system shall log access to or use of data-encrypting keys, including key creation, rotation, and destruction.
4.6 The system shall log the creation or deletion of system-level objects, datasets, or protected configuration files.
5. Data Access and High-Risk Operations
5.1 The system shall log all access to sensitive or regulated State data, including financial, personal, or cardholder data.
5.2 The system shall log all data import, export, bulk transfer, or generation of system-level reports.
5.3 The system shall log all submission or upload of user-generated content, including files or attachments.
5.4 The system shall log application-initiated network connections or outbound data transmissions.
6. Legal and Consent Events
6.1 The system shall log acceptance of terms of use, privacy notices, data usage statements, disclaimers, or other legal agreements.
6.2 The system shall log all user opt-ins or consent for mobile device capabilities, personal data usage, marketing communications, or other regulated actions.
General Requirements
7. Timestamping
7.1 All logs shall include accurate timestamps synchronized to a reliable time source (e.g., NTP).
7.2 All timestamps shall use a consistent time standard across all systems.
8. Log Integrity
8.1 Logs shall be protected against unauthorized modification or deletion.
8.2 The system shall generate integrity controls (e.g., hashing, checksums) to detect tampering.
9. Correlation
9.1 Logs shall contain sufficient detail to support event reconstruction, including at minimum: user or service account ID, session ID, source IP address, event type, resource accessed, and action taken.
10. Retention
10.1 Logs shall be retained in accordance with the State’s Enterprise Security Policies and applicable laws or regulations.
10.2 Archived logs shall remain accessible to the State upon request.
11. Availability and Access
11.1 Logs shall be made available to the State upon request for audits, investigations, or security reviews.
11.2 When required, the system shall support secure log forwarding to the State’s SIEM.
State of Illinois Chief Procurement Office for General Services Appendix S1 – Minimum Logging Requirements V.26.1
File details come from the government source that posted it. Updated .