NIST SP 800-92 4: Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control

Operate log management functions per NIST SP 800-92 Chapter 5 (Operational Processes) + Section 5.5 (Confidentiality, Integrity, and Availability of Logs). Time synchronisation per Section 5.6: deploy NTP (or equivalent) infrastructure with redundant authoritative sources + stratum hierarchy + drift monitoring + alerting + timezone normalisation in central log store (UTC preferred). Log parsing and normalisation per Section 5.7: parse incoming logs to a common schema (Common Event Format + Elastic Common Schema + or vendor schema) + maintain parser catalogue + versioning + test framework + monitoring for parsing failures. Log storage capacity planning per Section 5.8: tiered storage matching access pattern (hot for current incidents + warm for routine query + cold for retention + archive for long-term legal/regulatory) with capacity monitoring + scale triggers + cost optimisation. Log integrity protection per Section 5.9: write-once-read-many storage where regulator requires + cryptographic hash chains or signatures + tamper-evident logs + access logging on log management systems + separation of duties between log producers and log administrators. Access control to log data per Section 5.10: role-based access (analyst + admin + auditor + investigator + privileged + read-only) + MFA + just-in-time elevation where appropriate + access logging + periodic access review. Privacy and data minimisation in logs per Section 5.11: avoid logging sensitive content (passwords + tokens + cardholder data + PII beyond purpose) + redact at source where feasible + apply pseudonymisation for analytical use where applicable.