GM2 IS.I.OR.215(a)&(b) Information security internal reporting scheme

• ED Decision 2023/009/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

GM2 IS.I.OR.215(a)&(b) Information security internal reporting scheme ED Decision 2023/009/R ORGANISATION OF COLLECTION AND EVALUATION OF INFORMATION SECURITY EVENTS It is a common practice in large organisations to centralise information security operations in a security operations centre (SOC) and make use of an information security information and event management (SIEM) system. A SIEM system collects all events from sources such as log files in a common database and allows the analysts and responders in a joint SOC to review and act on these events. Organisations may choose to use a SOC for events relevant to Part-IS in isolation or in combination with events not subject to Part-IS but of interest to the organisation, such as events relating to business interests. Events can be automatically aggregated, correlated and analysed in order to detect abnormal behaviour leading to information security incidents. Organisations that do not have a SOC capability and do not use a SIEM system need to consider how to establish processes to meet the required collection and evaluation capabilities as well as detection and response times. ##### GM2 IS.I.OR.215(a)&(b) Information security internal reporting scheme *ED Decision 2023/009/R* **ORGANISATION OF COLLECTION AND EVALUATION OF INFORMATION SECURITY EVENTS** It is a common practice in large organisations to centralise information security operations in a security operations centre (SOC) and make use of an information security information and event management (SIEM) system. A SIEM system collects all events from sources such as log files in a common database and allows the analysts and responders in a joint SOC to review and act on these events. Organisations may choose to use a SOC for events relevant to Part-IS in isolation or in combination with events not subject to Part-IS but of interest to the organisation, such as events relating to business interests. Events can be automatically aggregated, correlated and analysed in order to detect abnormal behaviour leading to information security incidents. Organisations that do not have a SOC capability and do not use a SIEM system need to consider how to establish processes to meet the required collection and evaluation capabilities as well as detection and response times.