1. Document Control

• Document Title: Logging and Monitoring Policy

• Document Identifier: POL-ALL-008

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <Chief Information Security Officer>

• Approved By: <Information Security Governance Committee>

2. Purpose

The purpose of this Logging and Monitoring Policy is to establish requirements for the collection, storage, analysis, and review of logs to detect and respond to unauthorized activities, security incidents, operational disruptions, and compliance violations across 's systems and services.

This policy ensures that critical events are logged, relevant logs are protected against tampering, and monitored continuously to identify abnormal behavior or indicators of compromise. It is aligned with ISO/IEC 27001:2022 controls A.8.15 (Logging) and A.8.16 (Monitoring Activities), and SOC 2 Trust Criteria CC7.1 and CC7.2, which require real-time monitoring and timely detection of vulnerabilities and threats.

3. Scope

This policy applies to all systems, applications, databases, network devices, cloud platforms, and services that process or transmit 's information. It includes systems managed internally as well as those provided by third parties under contract.

It covers:

• Application logs

• System and security logs

• Authentication and access logs

• Network and firewall logs

• API and transaction logs

• Cloud activity logs (e.g., AWS CloudTrail, Azure Monitor)

All users, administrators, and vendors are subject to this policy when accessing or managing resources on behalf of .

4. Policy Statement

requires that:

1. All critical systems and services must generate logs of user activity, system events, authentication attempts, administrative actions, and security events.

2. Logs must be timestamped, secured, and protected from unauthorized access or modification.

3. Logs must be retained for a minimum of 12 months or longer if required by regulatory or contractual obligations.

4. Security Information and Event Management (SIEM) systems must be used for centralized log aggregation, correlation, and alerting.

5. Automated alerts must be configured for predefined events such as:

   • Failed logins

   • Privilege escalations

   • Changes to system configurations

   • Data export/download anomalies

6. Logs must be reviewed regularly by the Information Security Team and integrated with the organization's incident response and threat detection processes.

5. Safeguards

employs the following safeguards to support logging and monitoring: