Kibernetinio saugumo reikalavimų aprašas (KSRA)
Cyber Incident Management
22. The head of the cybersecurity entity or a person authorised by them must approve a cyber incident management plan, which must comply with the provisions of the National Cyber Incident Management Plan approved by the Government of the Republic of Lithuania.
23. Where network and information systems services relating to cyber incident management are provided to the cybersecurity entity by service providers, the entity's cyber incident management plan must be agreed with the service provider.
24. The cyber incident management plan must specify:
- 24.1. the methods for detecting cyber incidents
- 24.2. the assessment of cyber incidents
- 24.3. the organisation of cyber incident management
- 24.4. provisions on communicating cyber incidents to interested parties
- 24.5. the responsibilities of the employees who are responsible for cyber incident management
- 24.6. provisions on the identification, collection, obtaining, reporting and preservation of cyber incident evidence
- 24.7. the assessment of the experience gained in managing cyber incidents
- 24.8. provisions on testing the effectiveness of the cyber incident management plan and on preparing reports on the test results.
25. The cybersecurity entity must establish requirements for the administration and retention of logs and for intrusion detection and prevention, which must set out:
- 25.1. requirements for the retention and recording of logs of operating systems, network and information systems and hardware, and for how often they are analysed
- 25.2. requirements for the retention and recording of logs of inbound and outbound network traffic, antivirus software, the intrusion detection and prevention system or the firewall, and for how often they are analysed
- 25.3. requirements for collecting actions involving access to or modification of configuration and backup files of network and information systems.
26. The technical requirements applicable to cybersecurity entities are set out in Table 1.
All cybersecurity entities
1. At least the following logs must be recorded (where the network and information systems components support such functionality):
- 1.1. switching on, switching off or restarting network and information system components (servers, virtual servers, firewalls, routers, switches and other important components identified by the entity);
- 1.2. user and administrator authentication events;
- 1.3. creation of user and administrator accounts, changes to access to network and information systems;
- 1.4. actions performed by administrators;
- 1.5. system task events created and performed in operating systems (scheduled tasks);
- 1.6. changes to group policies;
- 1.7. changes to firewall rules;
- 1.8. switching the log collection function on or off;
<...>
- 1.10. switching security systems (antivirus, intrusion detection systems) on and off;
- 1.11. events of processes or services running in operating systems;
- 1.12. authentication events of network and information systems endpoint devices;
- 1.13. viewing, deleting, creating or modifying logs.
2. Network and information systems must have at least 2 time sources.
3. At least the following data must be recorded in the logs (where the network and information systems components support such functionality):
- 3.1. the date and exact time of the event;
<...>
- 3.3. identification data of the user / administrator and/or the network and information system device involved in the event;
- 3.4. a description of the event.
4. The measures used at the interface between the internal network and information system and the public electronic communications network must be configured so that all events relating to inbound and outbound data traffic are recorded in the logs.
<...>
7. Logs must be retained for at least 90 calendar days.
8. It is prohibited to delete or modify logs before the log retention period has expired.
9. Copies of logs must be protected against damage, loss, unauthorised modification or destruction.
10. The use of logs must be controlled and recorded; logs must be accessible only to persons authorised by the cybersecurity entity and to the cybersecurity manager (with viewing rights).
11. Log data must be analysed by an authorised person at least once a month, and the cybersecurity manager and/or the security officer must be informed of any deviations in the analysis results.
12. Intrusion detection systems must be deployed and operational to monitor data traffic entering and leaving the network and information system.
13. Unusual activity must be recorded in the logs and, where possible, an automated alert must be generated by automated means and made visible to the cybersecurity manager and/or the security officer.
14. The internal network and information systems of the cybersecurity entity must be separated from public communications networks using a firewall.
15. Firewall security rules must be reviewed on an ongoing basis and updated where necessary. A detailed analysis of the rules must be carried out at least once every 6 months.
Additionally, only for Essential cybersecurity entities
1. At least the following logs must be recorded (where the network and information systems components support such functionality):
- 1.9. changes to the time and date of operating systems;
3. At least the following data must be recorded in the logs (where the network and information systems components support such functionality):
- 3.2. the type of event (information, error, security message, system message, warning);
5. The logs recorded by the network and information systems must be stored in specialised hardware or software designed for that purpose.
6. If, due to various disruptions, audit data ceases to be recorded, the cybersecurity manager and/or the security officer must be informed immediately (by an automated alert), and no later than within one working day.