164.308(a)(1)(ii)(D) Information System Activity Review (Required)
Administrative safeguard · Required
The requirement as we hold it
Information System Activity Review (Required). Regularly review audit logs, access reports, and security incident tracking reports. NIST recommends defined review frequency, SIEM integration, anomaly detection, and documented review evidence.
The examiner asks
- Show me the last review of your audit logs, access reports and incident tracking, and tell me the cadence.
- What did the last review actually catch?
Evidence to bring
- the review cadence
- the most recent review evidence
Source: 164.308(a)(1)(ii)(D) at eCFR. Our statement of the clause, not the instrument verbatim.