15. Data Records

The Timestamp Authority MUST log the following information:

1. All data related to the creation of a timestamp, including all requests for a time-stamp, the connecting IP, and results of the timestamp,

2. Physical or remote access to a timestamp server, including the time of the access and the identity of the individual accessing the server,

3. History of the timestamp server configuration,

4. Any attempt to delete or modify timestamp logs,

5. Security events, including:

a. Successful and unsuccessful PKI system access attempts;

b. PKI and security system actions performed;

c. Security profile changes;

d. System crashes, hardware failures, and other anomalies;

e. Firewall and router activities; and

f. Entries to and exits from the CA facility

1. Revocation of a timestamp certificate,

2. Major changes to the timestamp server’s time,

3. System startup and shutdown, and

4. Equipment failures or malfunctions.

Data MUST be retained as specified in BR Section 5.4.3. except for item number 1 above which MUST be retained for a minimum of 5 days.