NIST SP 800-92 NISTSP92-1: Log Management Programme, Policy, Roles, and Operational Runbooks

Establish a log management programme per NIST SP 800-92 Chapter 2 (Introduction to Computer Security Log Management) + Chapter 4 (Log Management Planning). The programme must (a) define scope of logs covered (operating system + application + service + security tool + network device + cloud + SaaS + identity systems + database + storage), (b) document log management policy approved at senior level with categorisation of logs by criticality + sensitivity + retention class, (c) name accountable roles per Section 4.2: System Owners + Log Management Administrators + Log Reviewers + Privacy Officers + Information Security Officer + Audit Function + Legal + IR + Forensics + Incident Handlers + Application Owners + with documented responsibilities and SLA per role, (d) maintain operational runbooks covering log onboarding + parser maintenance + storage management + access requests + incident response triage + retention disposition + audit response, (e) integrate log management with broader NIST SP 800-53 AU family + NIST SP 800-137 continuous monitoring + NIST SP 800-61 incident response. Review the programme annually and after significant change (architecture + regulation + technology + threat landscape).