B-54592 Attachment A - Appendix s1 Minimum Loggin Rrequirements-v.26.1.docx
DOCX document 24 KB Posted
- Attached to
- Adobe Licensing
- Solicitation number
- 27-448DOIT-ADMIN-B-54592
- Issued by
- St. Clair County, Illinois
About this file
This is a Minimum Logging Requirements appendix (Appendix S1, Version 26.1) for a state and local contract opportunity issued by the State of Illinois Chief Procurement Office for General Services, specifically related to an Adobe Licensing procurement by the Illinois Department of Information Technology (DoIT). The document establishes comprehensive logging and monitoring standards that the system vendor must implement across multiple operational domains, including input and output validation events, authentication and access control activities, system and application events, privileged administrative activities, data access operations, and legal compliance tracking. The requirements mandate detailed logging of all security-relevant events such as authentication attempts, authorization failures, session management activities, password resets, configuration changes, malware detections, user account modifications, and access to sensitive state data. These logging specifications serve as technical requirements that any vendor solution must satisfy to ensure adequate audit trails and security monitoring capabilities.
The appendix specifies mandatory technical controls governing log management practices to support state oversight and compliance. All logs must include synchronized timestamps using a reliable time source, maintain integrity through protection mechanisms such as hashing or checksums, and contain sufficient detail for event reconstruction including user or service account identifiers, session IDs, source IP addresses, event types, accessed resources, and actions taken. Logs must be retained according to the State's Enterprise Security Policies and applicable regulations, with archived logs remaining accessible to Illinois upon request. The system must support secure log forwarding to the state's Security Information and Event Management (SIEM) system and make logs available for audits, investigations, and security reviews as required by the state. These requirements apply to any vendor providing Adobe software and licensing solutions to DoIT and establish baseline security logging standards for contract performance.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix S1 — Minimum Logging Requirements
1. Input and Output Validation Events
1.1 The system shall log all input validation failures, including protocol violations, unacceptable encodings, malformed data, and invalid or out-of-range parameters.
1.2 The system shall log all output validation failures, including unexpected data structures, encoding mismatches, data type errors, or inconsistent record sets.
2. Authentication and Access Control
2.1 The system shall log all authentication attempts, including successes, failures, account lockouts, MFA challenges, and MFA failures.
2.2 The system shall log all authorization failures (ie. failed MFA, wrong password, account lockout, account disabled, etc.) and denied access attempts to protected resources or functions.
2.3 The system shall log all session management events, including session creation, termination, timeout, token anomalies, and any modification of session identifiers.
2.4 The system shall log all password reset actions including, but not limited to reset requests, reset completions, and failed reset attempts.
2.5 The system shall log all security related profile changes including, but not limited to MFA device added or remove, update to MFA type, MFA reset actions, and MFA type addition or change.
3. System and Application Events
3.1 The system shall log all application errors and exceptions, including syntax, logic, runtime, and unhandled errors.
3.2 The system shall log connectivity issues, third-party service failures, and file system errors.
3.3 The system shall log all virus or malware detections, blocked file uploads, and quarantine actions.
3.4 The system shall log all configuration changes to system, application, or security settings.
3.5 The system shall log all system and application startup, shutdown, restart, and logging service initialization events (start, stop, or pause).
4. Privileged and Administrative Activity
4.1 The system shall log all use of administrative or elevated privileges.
4.2 The system shall log the creation, modification, disabling, or deletion of user accounts or groups.
4.3 The system shall log changes to privileges, roles, tokens, access rights, or identity mappings.
4.4 The system shall log the use of system-level administrative functions, command execution, and high-risk application actions.
4.5 The system shall log access to or use of data-encrypting keys, including key creation, rotation, and destruction.
4.6 The system shall log the creation or deletion of system-level objects, datasets, or protected configuration files.
5. Data Access and High-Risk Operations
5.1 The system shall log all access to sensitive or regulated State data, including financial, personal, or cardholder data.
5.2 The system shall log all data import, export, bulk transfer, or generation of system-level reports.
5.3 The system shall log all submission or upload of user-generated content, including files or attachments.
5.4 The system shall log application-initiated network connections or outbound data transmissions.
6. Legal and Consent Events
6.1 The system shall log acceptance of terms of use, privacy notices, data usage statements, disclaimers, or other legal agreements.
6.2 The system shall log all user opt-ins or consent for mobile device capabilities, personal data usage, marketing communications, or other regulated actions.
General Requirements
7. Timestamping
7.1 All logs shall include accurate timestamps synchronized to a reliable time source (e.g., NTP).
7.2 All timestamps shall use a consistent time standard across all systems.
8. Log Integrity
8.1 Logs shall be protected against unauthorized modification or deletion.
8.2 The system shall generate integrity controls (e.g., hashing, checksums) to detect tampering.
9. Correlation
9.1 Logs shall contain sufficient detail to support event reconstruction, including at minimum: user or service account ID, session ID, source IP address, event type, resource accessed, and action taken.
10. Retention
10.1 Logs shall be retained in accordance with the State’s Enterprise Security Policies and applicable laws or regulations.
10.2 Archived logs shall remain accessible to the State upon request.
11. Availability and Access
11.1 Logs shall be made available to the State upon request for audits, investigations, or security reviews.
11.2 When required, the system shall support secure log forwarding to the State’s SIEM.
State of Illinois Chief Procurement Office for General Services Appendix S1 – Minimum Logging Requirements V.26.1
File details come from the government source that posted it. Updated .