How can ManageEngine support SEPS Resolución 116 compliance?
With ManageEngine AD360, organizations can align with SEPS Resolución 116 requirements through role-based access control and segregation of duties across critical systems, automated identity lifecycle management that grants access on hire and revokes it on departure, periodic access certification that keeps entitlements matched to each role, conditional and privileged access controls over data-centre and critical systems, and backup and recovery of directory and identity objects to support disaster recovery. These capabilities help enforce the separation of functions the standard requires, control who reaches critical systems, and produce the identity and access evidence expected during supervisory review by SEPS.
Section IIISection III — Operational risk management
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 5(5) — Permanent monitoring of operational risk. Follow risks and the level of exposure permanently, supported by an organised scheme of reports that allows analysis of their evolution and knowledge of residual risk. | Log360 - Real-time security analytics, Security dashboards and scheduled reports, Alerting engine | Analyses events from servers, endpoints, network devices and cloud platforms without a break, giving the risk function the standing view of technology-factor exposure this stage depends on. Show current exposure and how risk events move over time, which is the organised reporting scheme the article asks for behind day-to-day decisions. Raises alerts on risk conditions as they appear, so residual risk gets acted on instead of surfacing late. |
| Art. 7(4) — Centralised risk-event base. Record identified risk events to build a centralised, historical, updated and sufficient event base holding information on failures or insufficiencies, including those of a legal nature, with their impact. | Log360 - Centralized log collection, Searchable archive with long-term retention, Event correlation | Pulls system, control and security failures into one repository, which becomes the historical event base the article describes. Keeps events in a searchable, tamper-evident archive, so the base stays complete enough to order and classify past failures. Links related events, so a recurring failure reads as one pattern in the record rather than a scatter of entries. |
| Art. 7(6) — Reporting scheme and key risk indicators. Design and maintain a scheme of reports with key operational-risk indicators, the evolution of risk events, a heat map of concentration by risk level, and the magnitude of loss. | Log360 - Prebuilt and custom reports, Dashboards and alert profiles | Produce technology-risk indicators and track how security events trend, feeding the reporting scheme used for decisions. Show where risk conditions cluster in real time, the technology-factor input to the entity's heat map. |
Section IVSection IV — Operational risk factors
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 13(2) — Confidentiality and post-employment duties. Keep confidentiality agreements current and determine information-security responsibilities and duties that remain in force after a change of functions or termination of the employment relationship. | Log360 - Real-time logon and account-change auditing | Watches logon activity and account changes, so any access that lingers after a role change or exit gets caught. |
| Art. 14(5)(a) — Data-centre access controls. Establish procedures for the operation and use of data centres, including controls that prevent unauthorised access. | Log360 - Privileged user activity monitoring, Real-time access auditing | Tracks and alerts on privileged activity against data-centre systems, making unauthorised access visible. Audits access to those systems and raises alerts, the evidence the article expects behind data-centre access controls. |
| Art. 14(5)(b) — IT incident and problem management. Maintain procedures for IT incident and problem management, including root-cause analysis, a knowledge base of known errors, action plans to mitigate recurrence, event and incident correlation, and key performance indicators. | Log360 - Automated incident management, Root-cause investigation, Correlation engine, Audit-ready incident reports | Correlates events into incidents and runs them through response workflows, the IT incident handling the article asks entities to keep. Traces a problem back to its cause through process lineage and correlation, the basis for the recurrence mitigation the article wants. Correlates events and incidents catalogued as problems, exactly the correlation the article calls out. Generate the performance and known-error records that fill out the knowledge base and indicators for problem management. |
| Art. 14(6)(d) — Segregated development, test and production environments. Maintain test, development and production environments with due segregation of access. | Log360 - Access and change auditing | Audits access and changes across development, test and production, so the required segregation is evidenced rather than assumed. |
| Art. 14(6)(e) — Source-code vulnerability mitigation. Mitigate the vulnerabilities of the source code of applications. | Log360 - Security and risk posture management, Security analytics | Surfaces exposure and misconfiguration on the systems that host and run applications, which covers part of what the article asks for. Detects attempts to exploit application weaknesses. It does not test source code, so a dedicated code-scanning tool is still needed to close this article. |
| Art. 14(6)(g) — Change-control procedures. Maintain change-control procedures covering registration, version handling, segregation of functions and authorisations, including emergency changes. | Log360 - Change auditing, File integrity monitoring | Records who changed what and when across applications and infrastructure, the registration a change-control procedure runs on. Tracks version integrity and flags unauthorised change, which covers the version handling the article names. |
| Art. 14(6)(h) — Information-migration controls. Maintain information-migration procedures with controls that guarantee the integrity, availability and confidentiality of the information. | Log360 - File integrity monitoring, Data classification, Integrated DLP, Audit trails | Detects unauthorised modification of migrated data, protecting the integrity migration controls are meant to guarantee. Identifies sensitive content, so the right confidentiality controls follow the data through the migration. Stops information leaking while it is in transit, which guards the confidentiality the article calls for. Keep a tamper-evident record of the migration, backing the integrity and availability the article requires. |
| Art. 14(7)(a) — Infrastructure configuration control. Maintain procedures for the administration, monitoring and configuration registry of databases, data networks, hardware and base software, including limits and alerts. | Log360 - Configuration and change auditing, Database activity monitoring, Network device log analysis | Records and monitors configuration for databases, network devices and base software, the configuration registry the article asks for. Watches database access and configuration against thresholds and alerts, covering the administration and monitoring side. Collects and analyses network logs against set limits, which delivers the alerting the article names. |
| Art. 14(7)(f) — Technology infrastructure inventory. Maintain an updated inventory of the technology infrastructure, including registration and dated control of asset entry and exit. | Log360 - Asset and log-source discovery | Enumerates the technology assets sending telemetry across the network, which keeps the infrastructure inventory current. |
| Art. 14(9) — Change authorisation and integrity. Ensure changes to applications and infrastructure are authorised, documented, tested and approved before production, with separated libraries, version integrity and promotion by a group independent of the programmers. | Log360 - Change auditing, File integrity monitoring, Real-time alerting | Shows that changes were documented and approved, with a record of each one before it reaches production. Protects version integrity between development and production libraries, the integrity the article wants preserved. Flags unauthorised or untested changes, so only approved ones make it to production. |
| Art. 15 — External events — cyber-attacks and external fraud. Consider losses derived from events outside the entity's control such as cyber-attacks, external fraud and other criminal acts, managing them within business-continuity administration. | Log360 - MITRE-mapped threat detection, UEBA anomaly detection, Threat intelligence, SOAR | Catches intrusion, malware and account compromise with over 2,000 MITRE ATT&CK-mapped rules, the cyber-attacks the article names. Baselines user and entity behaviour and scores the deviations, which surfaces the external-fraud and attack patterns the article wants considered. Adds indicators of compromise and reputation feeds to detection, exposing external threats the article expects entities to guard against. Runs automated containment once an attack is detected, holding down the losses external events can cause. |
Section IVSection IV — Incident and problem management (Art. 16)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 16(1) — Incident handler and traceability. Assign an incident and problem handler responsible for traceability through to closure of incidents and problems, and their registration in the database. | Log360 - Incident management console, Automated ticketing, AI-assisted incident timelines | Gives the assigned handler one place to own each incident to closure, the traceability the article requires. Opens and tracks a record for every incident, which is the database registration the article asks for. Reconstruct how an incident unfolded, backing the trace from detection through to closure. |
| Art. 16(3) — Full incident life cycle. Cover the full incident life cycle: registration, prioritisation by severity, analysis, escalation, resolution, monitoring, lessons learned and reporting to internal and external parties. | Log360 - Automated incident management, Alert prioritization, SOAR playbooks, Incident Workbench | Handles registration, escalation, resolution and monitoring in one workflow, which covers the life cycle the article lays out. Ranks incidents by severity, the prioritisation step the article names. Automate analysis and resolution steps, the resolution stage in practice. Pulls context together for analysis and for the reporting to internal and external parties the article closes on. |
| Art. 16(4) — Problem management and root cause. Analyse the root cause of problems, maintain a knowledge base of known errors, define action plans to mitigate recurrence, and correlate events and incidents catalogued as problems. | Log360 - Root-cause investigation, Event and incident correlation, Incident Workbench | Establishes the root cause of a problem through process lineage and correlation, which the article requires for recurrence mitigation. Correlates events and incidents catalogued as problems, the correlation the article names. Consolidates related events into one view, feeding the known-errors knowledge base the article wants kept. |
| Art. 16 — Availability of critical services (99.99%). Guarantee the availability of critical services offered to financial users at ninety-nine point ninety-nine per cent per year, excluding scheduled maintenance. | Log360 - Real-time monitoring, Availability and uptime alerting | Watches critical services continuously, the visibility needed to hold the 99.99% annual availability the article sets. Alerts on degradation and outage of critical services as it happens, which protects that availability target. |
Section VSection V — Business continuity management (Art. 17)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 17(4)(f) — Disaster-recovery plan. Maintain a disaster-recovery plan detailing the technological restoration procedures for IT services in a remote location. | Log360 - Backup-job monitoring | Monitors backup jobs and audits restoration, the evidence a disaster-recovery plan leans on. |
| Art. 17(4)(g) — IT-failure risk mitigation. Identify the risks arising from failures in information technology and manage an action plan to mitigate the identified risks. | Log360 - Security and risk posture management, Attack-surface visibility | Scans configurations for misconfiguration and exposure, turning up the IT-failure risks that feed a mitigation plan. Shows exposure points across critical environments, which informs the action plan the article asks for. |
Section VISection VI — Third-party services (Arts. 18–23)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 18(12) — Provider information security and data protection. Require information security, including cybersecurity and personal-data protection, over the entity's information used by the provider in delivering the service. | Log360 - Cloud security monitoring, Integrated DLP and data classification | Extends monitoring to the hosted and cloud environments where provider-managed information sits, covering the information-security and cybersecurity side. Classify and control the entity's sensitive data in the provider's hands, which protects the personal data the article wants safeguarded. |
| Art. 18(14) — Risk management of critical outsourced services. Manage the risks of critical services provided by third parties, guaranteeing information-security management, including cybersecurity, and business-continuity management. | Log360 - Cloud and hosted-environment monitoring, Incident management | Watches third-party critical services for security events, the information-security and cybersecurity management the article requires. Drives incidents in outsourced critical services to resolution, part of managing third-party risk. |