Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have a system that outputs and rotate logs on a daily basis.

If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day log? Or can we provide, say an omitted log or screenshot of the log portion that shows only portion of the particular task? Would auditor questions the integrity of partial / omitted / screenshot of logs?

My personal answer is that I would not agree to providing complete full day log as these logs may contain other confidential or sensitive information that may be out of the audit scope.

share|improve this question
3  
depends on the audit –  tylerl Feb 20 '13 at 2:29
    
^+1 It really depends on the audit. If I was an QSA working on your SAQ, I would question your intentions. –  g3k Feb 20 '13 at 16:35
add comment

1 Answer

This depends on the type of the audit and the contract between your company and the auditing company. Furthermore privacy laws, agreements concerning privacy related data and NDAs may play an important role in judging the request.

As a practical advice: Ask your legal department as this is not a question rooted in IT but in laws and contracts. Try to explain your concerns in a way that is understandable to lawyers with little IT background.

You can try to provide a stripped down log as initial response and ask the auditor to clarify if additional data is needed and why. But whether this approach is a good idea or not, depends on the situation.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.