Security questionnaire answers › Incident response
Do you log and monitor security events? How to answer it in a security questionnaire
Why buyers ask this
Without logs and alerts, a breach can go unnoticed for months.
What a strong answer includes
- Say what is logged (authentication, admin actions, data access, network) and where it is stored.
- State retention (commonly 12 months) and log integrity protection.
- Mention alerting and who responds.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. We centrally collect logs for authentication, administrative actions and system events, retain them for [12 months], and restrict and protect them from alteration. Alerts for suspicious activity route to [on-call/security team].
Evidence to attach
- Logging configuration
- Alert rule list
- Retention policy
Common mistakes
- Logs retained for days only.
- Logging without anyone watching alerts.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.