What are the security considerations for logging?

When you hold information about people that relates to law enforcement, there is a greater risk of harm if it is lost or misused. Victims and witnesses can be put at risk of harm if personal information is inappropriately accessed or shared. You must already be logging the access to such information as part of your wider information security considerations for the systems you use. Auditable logs of user behaviour are important for accountability. You must keep logs safe and secure, especially if you need them as evidence for disciplinary matters or a criminal investigation.

You should periodically review your logs in a way that allows you to identify any unauthorised actions, trends or patterns of behaviour as part of your protective monitoring of your systems. If users of systems know that you review logs, this can help deter them from inappropriate or unauthorised use of personal information.

You should ensure that system users cannot alter logging information themselves. This is to secure the confidentiality, integrity and availability of the records. For security purposes, you should only allow enhanced access to select people in your organisation to be able to view full logs. This prevents general users or external hackers from altering the logging records to cover up any suspicious activity or attacks.