10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter.
10.5.3 Current audit trail files are promptly backed up to a centralized log server or media that is difficult to alter.
Adequate protection of the audit logs includes strong access control (limit access to logs based on “need to know” only), and use of physical or network segregation to make the logs harder to find and modify.
Promptly backing up the logs to a centralized log server or media that is difficult to alter keeps the logs protected even if the system generating the logs becomes compromised.