Halden Foods: who can read the sign-in log, and how long is it kept?
Description
Halden Foods is in procurement with us. Ingrid Solberg, their CISO, sent this on behalf of Halden's internal auditors:
Our auditors want to know two things about the log of sign-ins and approvals: who at Halden will be able to read it, and how long ACME keeps it.
It came separately from the security questionnaire they're sending us. Can support confirm both so I can answer Ingrid?
Tom
Linked issues
- relates to SUP-1257 Halden Foods: penetration test summary when the report arrives Done
Comments (6)
Who: administrators read the sign-in log and the approvals audit log in the portal, for their own organisation only; nobody else at the customer can. How long: the approvals audit log keeps every decision for 400 days. The sign-in log keeps 90 days; that isn't written anywhere a customer can read, I found it in the portal's sign-in log and the nightly clean-up. Mira, can you confirm 90 days is something we stand behind before Tom tells a CISO?
Confirmed: 90 days for sign-ins, 400 days for approval decisions. Halden will want twelve months of sign-ins and their auditors reading the log themselves; that's ACM-324, which Tom started this morning. Don't promise either yet.
Sent to Ingrid by email:
Who can read it: only Halden's administrators, in the portal, for Halden's organisation. How long it's kept: the approvals audit log keeps every decision for 400 days, and administrators can export it. The sign-in log keeps 90 days. We know your auditors look back twelve months and would rather read the log themselves. We're working out how to offer both and will tell you when we can commit to it.
Ingrid: thanks, clear. Wants the twelve months in writing before they sign; tracking it in ACM-324. Closing this.
Ingrid signed off Halden's security review today. The twelve-month sign-in log stays a follow-up (ACM-324), no date promised.
Ingrid's original email attached. It'll come back in the questionnaire, so worth getting exactly right.