1. Purpose To provide accurate and comprehensive audit logs in order to detect and react to inappropriate access to, or use of, information systems or data.
2. Applicability This policy applies to all Information Systems that store, process or transmit University Data.
3. Definitions Information System: An individual or collection of computing and networking equipment and software used to perform a discrete business function. Examples include the eLearning System, ISIS, the EPIC electronic medical records system, a lab system and associated PC or the set of desktop computers used to perform general duties in a department.

University of Florida Data: Data in any format collected, developed, maintained or managed by or on behalf of the University, or within the scope of University activities. The terms ‘data’ and ‘information’ are used interchangeably in the context of the information security program.

4. Policy Statement

1. Access to Information Systems and data, as well as significant system events, must be logged by the Information System.
2. Information System audit logs must be protected from unauthorized access or modification.
3. Information System audit logs must be retained for an appropriate period of time, based on the Document Retention Schedule and business requirements. Audit logs that have exceeded this retention period should be destroyed according to UF document destruction policy.

Additional Resources

History