A.16.1.7: Collection of Evidence
Define and apply procedures for the identification, collection, acquisition, and preservation of information, which can serve as evidence.
A.16.1.6: Learning from Information Security Incidents
Collect and use information about information security incidents to improve the response process.
A.16.1.5: Response to Information Security Incidents
Respond to information security incidents in accordance with the documented procedures.
A.16.1.4: Assessment of and Decision on Information Security Events
Assess information security events and decide if they are to be classified as information security incidents.
A.16.1.2: Reporting Information Security Events
Ensure that information security events are reported through appropriate management channels as quickly as possible.
A.12.4.3: Administrator and Operator Logs
Ensure that administrator and operator logs are logged and protected.
A.12.4.2: Protection of Log Information
Protect log information against tampering and unauthorized access.
A.12.4.1: Event Logging
Implement event logging to record user activities, exceptions, and information security events.