Appendix-S1-minimum-logging-requirements-v.26.1.docx
DOCX document 24 KB Posted
- Contract number
- 27-494DOT-FINAD-P-98562
- Issued by
- Illinois
About this file
This document is Appendix S1 - Minimum Logging Requirements, version 26.1, issued by the State of Illinois Chief Procurement Office for General Services. It establishes mandatory logging and security event documentation standards for information technology systems and applications contracted with or used by the State of Illinois.
The appendix specifies comprehensive logging requirements across eleven categories: input and output validation events, authentication and access control activities, system and application events, privileged and administrative activities, data access and high-risk operations, and legal and consent events. Key operational requirements include mandatory timestamping synchronized to reliable time sources, log integrity protections against unauthorized modification or deletion with integrity controls such as hashing and checksums, and event correlation with sufficient detail for reconstruction including user or service account identification, session IDs, source IP addresses, event types, accessed resources, and actions taken. Logs must be retained in accordance with State Enterprise Security Policies and applicable laws, remain accessible upon State request for audits and investigations, and support secure forwarding to the State's Security Information and Event Management (SIEM) system when required. This specification applies to all contracted vendors and service providers delivering systems to the State of Illinois.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix S1 — Minimum Logging Requirements
1. Input and Output Validation Events
1.1 The system shall log all input validation failures, including protocol violations, unacceptable encodings, malformed data, and invalid or out-of-range parameters.
1.2 The system shall log all output validation failures, including unexpected data structures, encoding mismatches, data type errors, or inconsistent record sets.
2. Authentication and Access Control
2.1 The system shall log all authentication attempts, including successes, failures, account lockouts, MFA challenges, and MFA failures.
2.2 The system shall log all authorization failures (ie. failed MFA, wrong password, account lockout, account disabled, etc.) and denied access attempts to protected resources or functions.
2.3 The system shall log all session management events, including session creation, termination, timeout, token anomalies, and any modification of session identifiers.
2.4 The system shall log all password reset actions including, but not limited to reset requests, reset completions, and failed reset attempts.
2.5 The system shall log all security related profile changes including, but not limited to MFA device added or remove, update to MFA type, MFA reset actions, and MFA type addition or change.
3. System and Application Events
3.1 The system shall log all application errors and exceptions, including syntax, logic, runtime, and unhandled errors.
3.2 The system shall log connectivity issues, third-party service failures, and file system errors.
3.3 The system shall log all virus or malware detections, blocked file uploads, and quarantine actions.
3.4 The system shall log all configuration changes to system, application, or security settings.
3.5 The system shall log all system and application startup, shutdown, restart, and logging service initialization events (start, stop, or pause).
4. Privileged and Administrative Activity
4.1 The system shall log all use of administrative or elevated privileges.
4.2 The system shall log the creation, modification, disabling, or deletion of user accounts or groups.
4.3 The system shall log changes to privileges, roles, tokens, access rights, or identity mappings.
4.4 The system shall log the use of system-level administrative functions, command execution, and high-risk application actions.
4.5 The system shall log access to or use of data-encrypting keys, including key creation, rotation, and destruction.
4.6 The system shall log the creation or deletion of system-level objects, datasets, or protected configuration files.
5. Data Access and High-Risk Operations
5.1 The system shall log all access to sensitive or regulated State data, including financial, personal, or cardholder data.
5.2 The system shall log all data import, export, bulk transfer, or generation of system-level reports.
5.3 The system shall log all submission or upload of user-generated content, including files or attachments.
5.4 The system shall log application-initiated network connections or outbound data transmissions.
6. Legal and Consent Events
6.1 The system shall log acceptance of terms of use, privacy notices, data usage statements, disclaimers, or other legal agreements.
6.2 The system shall log all user opt-ins or consent for mobile device capabilities, personal data usage, marketing communications, or other regulated actions.
General Requirements
7. Timestamping
7.1 All logs shall include accurate timestamps synchronized to a reliable time source (e.g., NTP).
7.2 All timestamps shall use a consistent time standard across all systems.
8. Log Integrity
8.1 Logs shall be protected against unauthorized modification or deletion.
8.2 The system shall generate integrity controls (e.g., hashing, checksums) to detect tampering.
9. Correlation
9.1 Logs shall contain sufficient detail to support event reconstruction, including at minimum: user or service account ID, session ID, source IP address, event type, resource accessed, and action taken.
10. Retention
10.1 Logs shall be retained in accordance with the State’s Enterprise Security Policies and applicable laws or regulations.
10.2 Archived logs shall remain accessible to the State upon request.
11. Availability and Access
11.1 Logs shall be made available to the State upon request for audits, investigations, or security reviews.
11.2 When required, the system shall support secure log forwarding to the State’s SIEM.
State of Illinois Chief Procurement Office for General Services Appendix S1 – Minimum Logging Requirements V.26.1
File details come from the government source that posted it. Updated .