SP 800-92Final2006

Guide to Computer Security Log Management

At a glanceHow to plan and run log management: which logs to collect, how to store and protect them, and how to review them. The final is from 2006; a 2023 draft playbook (Revision 1) gives a shorter, more current planning approach. Useful before buying a log or monitoring service.

Reading level: Technical
Length: 72 pages · about 40 min for the key parts
Best for: Technology directors, IT staff and service partners
CSF 2.0: Detect, Protect

Read it on NIST DOI 10.6028/NIST.SP.800-92 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Revision in progress. SP 800-92 Rev. 1 initial public draft, 'Cybersecurity Log Management Planning Guide' (2023-10-11), organizes planning as a short playbook; comments closed 2023-11-29 and no final has been published.

Key concepts

The guide explains why logs matter for security, the infrastructure that generates, stores and analyzes them, how to plan a log management program and the day-to-day operational processes. It describes technologies at a high level.

How it is organized

Introduction to computer security log management
Log management infrastructure
Log management planning
Log management operational processes

What a school district should take from it

You cannot investigate an incident with logs you did not keep. Decide retention before you need it.
Cloud identity and email audit logs are often the most valuable and the easiest to turn on.

How to use it in your district

List the logs that matter most: identity provider sign-ins, email, firewall, VPN, servers and endpoint protection.
Set retention long enough to investigate, and check what your insurer or pool expects.
Assign someone to review alerts weekly, or contract the service.
Protect logs from deletion by the accounts they record.

Common misconceptions

Collecting logs equals monitoring.: Logs only help when someone reviews alerts or can search them during an investigation.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

DE.CMContinuous Monitoring
DE.AEAdverse Event Analysis
PR.PSPlatform Security

Tools in the program portal

Evidence collection kitsCollect configuration evidence from Microsoft 365, Google and more
Cyber insurancePolicy conditions, questionnaire and Breach Day card
Incident respondersLine up outside response help before you need it

Related publications

SP 800-94Intrusion detection and prevention
SP 1800-26Ransomware: detect and respond

Citation and source

SP 800-92, Guide to Computer Security Log Management. National Institute of Standards and Technology. 2006. https://doi.org/10.6028/NIST.SP.800-92.

Topics: Logging and detection. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.