How can ManageEngine support SUSEP 638 compliance?
With ManageEngine Log360, organizations can align with SUSEP 638 requirements through centralized log collection and correlation across the systems that hold relevant data, continuous auditing of who accessed which records and when, real-time detection of security incidents with automated alerting and AI-assisted timelines to support the five-business-day notification to SUSEP, file integrity monitoring over critical data, and secure, long-term log retention for the annual incident report. These capabilities help implement the circular's technical controls, enforce accountability, and produce the audit evidence expected during regulatory scrutiny.
Chapter IIIChapter III — General provisions (Art. 3)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 3 Cybersecurity shall be inserted into the general context of the Internal Controls System (SCI) and the Risk Management Framework (EGR); the entity shall additionally observe national and international good cybersecurity practices and treat cyber risk within the operational-risk category. | Log360 - Security and risk posture management, attack surface exposure analysis, real-time security analytics, compliance reporting | Log360's security and risk posture assessment flags misconfigurations and attack-surface exposure. |
Chapter IVChapter IV — Cybersecurity policy (Art. 4)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 4 (III)(a) The cybersecurity policy shall set parameters and guidelines for classifying data, incidents, and services according to their relevance. | Log360 - Automated data discovery and e-discovery, data classification, integrity monitoring | Log360's automated e-discovery scans the network for confidential data and classifies it by the risk and the type of personal information it holds, operationalising the data-classification portion of the policy. Classifying incidents and services by relevance is a risk-rating decision the entity defines; Log360 supplies asset and sensitivity context but does not set the relevance thresholds. |
Chapter VChapter V — Prevention, detection, and response to incidents (Arts. 5–9)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 5 (I) The entity shall have, and keep up to date, processes, procedures, and controls to identify and reduce vulnerabilities. | Log360 - Security and risk posture management, attack-surface exposure analysis, integrity monitoring, threat detection | Log360's risk posture assessment identifies misconfigurations and security gaps and surfaces attack-surface exposure. |
| Art. 5 (II) The entity shall have, and keep up to date, processes, procedures, and controls to detect, respond to, and recover from incidents. | Log360 - Vigil IQ TDIR, real-time event correlation, alerting, SOAR with 50+ default playbooks, Incident Workbench | Log360 detects incidents through correlation and 2,000+ MITRE-mapped detections, then drives response through its SOAR playbooks and the Incident Workbench. |
| Art. 6 (caput) The incident-handling processes referred to in Art. 5(II) shall include measures to detect, register, and trace incidents across affected systems. | Log360 - Centralized log management, time-stamped audit trail, real-time correlation, UEBA, threat intelligence | Log360 centrally collects and retains time-stamped logs and correlates events across the environment, with UEBA and threat-intelligence matching to detect adverse events and reconstruct what occurred. This provides the detection, registration, and traceability the incident processes require. |
| Art. 6 (III) The incident-handling processes shall include containment measures, with prior communication to providers, partners, and other affected parties where pertinent. | Log360 - SOAR with 50+ default playbooks, visual playbook builder, correlation-driven alerting | Log360's SOAR executes automated containment workflows, disabling accounts, isolating endpoints, and blocking addresses. |
| Art. 6 (VIII) The incident-handling processes shall include identification and treatment of the exploited vulnerabilities. | Log360 - Root-cause investigation, process-lineage visuals, security and risk posture management | Log360's Incident Workbench uses correlation and process-lineage visuals to establish how an incident occurred, and its risk posture assessment confirms the underlying misconfiguration is closed |
| Art. 7 The processes referred to in Art. 6(II)–(IV) shall be provided for in the business continuity plan, at least for the relevant scenarios. | Log360 - Documented incident-response workflows, long-term log retention for investigation | Log360 preserves the log evidence and documented response workflows the continuity plan relies on for relevant scenarios. |
| Art. 8 On becoming aware of a relevant incident, the entity shall inform SUSEP within five business days, detailing the extent of the damage and, where applicable, the remediation under way with responsible parties and deadlines. | Log360 - Incident management console, AI-automated incident timelines, audit-ready reports, root-cause investigation | Log360's incident console consolidates incident detail, its AI-automated timelines reconstruct the sequence and reach of the event, and its audit-ready reports document the damage extent and remediation under way, supplying the information the entity must report to SUSEP within the five-business-day deadline. Submitting the notification to SUSEP is a manual filing the entity performs. |
| Art. 9 The entity shall prepare an annual report on the prevention and treatment of incidents, with statistics on detected incidents, their causes and effects, and the responses adopted. | Log360 - Compliance and audit reporting, incident statistics dashboards, root-cause investigation, searchable archive | Log360 compiles statistics on detected incidents, their causes and effects, and the responses taken from its retained incident records and audit-ready reports, providing the evidence base for the annual report the clause requires. |
Chapter VIChapter VI — Outsourcing of data processing and storage (Arts. 10–11)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 10 (I) When outsourcing data processing and storage services, the entity shall have the resources, competencies, and governance practices needed to adequately monitor the services to be contracted. | Log360 - Cloud security monitoring, multi-source log collection, CASB, real-time analytics | Log360 extends monitoring to cloud and hosted environments and ingests logs from outsourced services. |
| Art. 11 (II) The entity shall require providers to make available the information and management resources that allow the entity to adequately monitor the contracted services. | Log360 - Multi-source and cloud log collection, real-time correlation, CASB, alerting | Where providers expose logs and management interfaces, Log360 ingests and correlates that telemetry through its cloud-security and multi-source collection so the entity can monitor the contracted services as the clause requires. Obtaining the contractual right to that telemetry is a procurement action the entity takes. |
| Art. 11 (III) The entity shall require providers to maintain cybersecurity processes, procedures, and controls not inferior to its own for the same sensitivity level. | Log360 - Cloud security monitoring, security posture visibility, threat detection over provider environments | Log360 monitors provider-hosted environments and surfaces posture and threats, giving the entity continuous evidence of whether provider controls remain not inferior to its own. Mandating the standard contractually and assessing the provider before engagement are organisational and procurement actions the products do not perform. |
| Art. 11 (IV) The entity shall require providers to ensure, through physical and/or logical controls, that the entity's and its clients' data is segregated from other clients' data. | Log360 - Integrated DLP, data discovery, exfiltration anomaly detection, integrity monitoring | Log360's DLP and AI-powered exfiltration anomaly detection flag abnormal movement of the entity's data across boundaries, and its discovery locates where that data resides, giving the entity detection over segregation failures. The physical or logical segregation control itself is implemented in the provider's architecture, not by AD360 or Log360. |
Chapter VIIChapter VII — Transitional and final provisions (Art. 15)
| Clause | Functionality | Explanation |
|---|---|---|
| Art. 15 The entity shall retain current and previous versions of the cybersecurity policy, the incident prevention and treatment report (Art. 9), and the relevant outsourcing contracts. | Log360 - Long-term log retention and archival, searchable archive, audit-ready report retention | Log360 retains and archives time-stamped log data and dated copies of incident reports over long periods, covering retention of the Art. 9 incident report and its supporting evidence. Versioned retention of the policy document and the outsourcing contracts is a document-management function outside AD360 and Log360; the entity should retain those in a document or contract-management system. |