1. Document Control

• Document Title: Log Management Procedure

• Document Identifier: PRC-IT-009

• Version Number: v1.0

• Approval Date: <24 June 2025>

• Effective Date: <24 June 2025>

• Review Date: <24 June 2026>

• Document Owner: <Director of Information Security>

• Approved By: <Information Security Governance Committee>

2. Purpose

The purpose of this procedure is to define the requirements for generating, storing, protecting, and reviewing log data to support security monitoring, incident detection, and forensic investigations. Effective log management enables to detect anomalies, establish audit trails, and meet legal, regulatory, and certification obligations.

This procedure is aligned with SOC 2 Trust Services Criteria CC7.1 and CC7.2 and ISO/IEC 27001:2022 controls A.8.15 (logging) and A.8.16 (monitoring), ensuring that event logging and log review practices support comprehensive security operations and accountability.

3. Scope

This procedure applies to all systems, applications, network devices, databases, and cloud services under 's ownership or control that handle production data, security events, authentication requests, or critical operations.

Personnel responsible for system administration, information security, DevOps, or managed service provision are required to comply. This includes both in-house and third-party environments.

4. Policy Statement

shall implement centralized log collection and management procedures that ensure:

1. Logging of key events, including login attempts, access to sensitive data, changes to configuration, and security alerts.

2. Logs are securely transmitted to and stored in a centralized Security Information and Event Management (SIEM) system.

3. Logs are time-synchronized using NTP to ensure consistency across systems.

4. Logs are retained for a minimum of 12 months in accordance with legal and compliance requirements.

5. Logs are reviewed daily by security analysts for anomalies and indicators of compromise.

6. Access to logs is restricted to authorized personnel only, and all access is logged.

7. Integrity of logs is ensured through cryptographic protections and access control mechanisms.

8. Review failures, log gaps, or anomalies are reported and remediated within defined SLAs.

5. Safeguards