This sample policy is designed to help organizations define and comply with system audit logging and monitoring requirements.

In this sample, audit trails must exist on all systems where technologically possible; audit trails must be configured at all technology infrastructure levels, including the application, database and platform layers; access to audit trails must be restricted to individuals with a job-related need; audit trails from all systems must be saved to a centralized log server; audit trails must be adequately protected; and audit trails must record all access to credit card numbers and be configured at all levels of the technology infrastructure.