Appendix S1 — Minimum Logging Requirements

1. Input and Output Validation Events

1.1 The system shall log all input validation failures, including protocol violations, unacceptable encodings, malformed data, and invalid or out-of-range parameters.

1.2 The system shall log all output validation failures, including unexpected data structures, encoding mismatches, data type errors, or inconsistent record sets.

2. Authentication and Access Control

2.1 The system shall log all authentication attempts, including successes, failures, account lockouts, MFA challenges, and MFA failures.

2.2 The system shall log all authorization failures (ie. failed MFA, wrong password, account lockout, account disabled, etc.) and denied access attempts to protected resources or functions.

2.3 The system shall log all session management events, including session creation, termination, timeout, token anomalies, and any modification of session identifiers.

2.4 The system shall log all password reset actions including, but not limited to reset requests, reset completions, and failed reset attempts.

2.5 The system shall log all security related profile changes including, but not limited to MFA device added or remove, update to MFA type, MFA reset actions, and MFA type addition or change.

3. System and Application Events

3.1 The system shall log all application errors and exceptions, including syntax, logic, runtime, and unhandled errors.

3.2 The system shall log connectivity issues, third-party service failures, and file system errors.

3.3 The system shall log all virus or malware detections, blocked file uploads, and quarantine actions.

3.4 The system shall log all configuration changes to system, application, or security settings.

3.5 The system shall log all system and application startup, shutdown, restart, and logging service initialization events (start, stop, or pause).

4. Privileged and Administrative Activity

4.1 The system shall log all use of administrative or elevated privileges.

4.2 The system shall log the creation, modification, disabling, or deletion of user accounts or groups.

4.3 The system shall log changes to privileges, roles, tokens, access rights, or identity mappings.

4.4 The system shall log the use of system-level administrative functions, command execution, and high-risk application actions.

4.5 The system shall log access to or use of data-encrypting keys, including key creation, rotation, and destruction.

4.6 The system shall log the creation or deletion of system-level objects, datasets, or protected configuration files.

5. Data Access and High-Risk Operations

5.1 The system shall log all access to sensitive or regulated State data, including financial, personal, or cardholder data.

5.2 The system shall log all data import, export, bulk transfer, or generation of system-level reports.

5.3 The system shall log all submission or upload of user-generated content, including files or attachments.

5.4 The system shall log application-initiated network connections or outbound data transmissions.

6. Legal and Consent Events

6.1 The system shall log acceptance of terms of use, privacy notices, data usage statements, disclaimers, or other legal agreements.

6.2 The system shall log all user opt-ins or consent for mobile device capabilities, personal data usage, marketing communications, or other regulated actions.

General Requirements

7. Timestamping

7.1 All logs shall include accurate timestamps synchronized to a reliable time source (e.g., NTP).

7.2 All timestamps shall use a consistent time standard across all systems.

8. Log Integrity

8.1 Logs shall be protected against unauthorized modification or deletion.

8.2 The system shall generate integrity controls (e.g., hashing, checksums) to detect tampering.

9. Correlation

9.1 Logs shall contain sufficient detail to support event reconstruction, including at minimum: user or service account ID, session ID, source IP address, event type, resource accessed, and action taken.

10. Retention

10.1 Logs shall be retained in accordance with the State’s Enterprise Security Policies and applicable laws or regulations.

10.2 Archived logs shall remain accessible to the State upon request.

11. Availability and Access

11.1 Logs shall be made available to the State upon request for audits, investigations, or security reviews.

11.2 When required, the system shall support secure log forwarding to the State’s SIEM.

State of Illinois Chief Procurement Office for General Services Appendix S1 – Minimum Logging Requirements V.26.1