Division 2.16

All system activity logs are in place. The system makes sure that audit logs recording exceptions and other security-relevant events listed below may be produced and kept until the data is destroyed in accordance with Article 12(3) or (5) of Regulation (EU) No 211/2011. Logs are adequately protected, for instance by storage on encrypted media. Organisers/administrators regularly check the logs for suspicious activity. Log contents include at least:

1. (a)

   dates and times for log-on and log-off by organisers/administrators;

2. (b)

   performed backups;

3. (c)

   all database administrator changes and updates.