# How do we prove who changed a security setting, and when?

With an audit log that records each change, the person who made it and the time, kept where it cannot be quietly edited. For your own systems, that means enabling change logging on firewalls, directory services, cloud consoles and security tools, sending the logs to a central place with restricted access, and linking changes to approved tickets. Shared administrator accounts make proof impossible, so give each person their own named account with multi-factor authentication. Review the logs for unexpected changes, especially outside working hours. For NetSenX itself, the audit log on every plan records who changed detection settings, notification rules or team members and who decided on alerts, with timestamps; you can export the extract for an auditor. It covers changes made in NetSenX, not settings in your other systems.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/how-do-we-prove-who-changed-a-security-setting

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [How do we show an auditor which parts of our network are monitored?](https://netsenx.com/en/faq/how-do-we-show-an-auditor-which-parts-of-the-network-are-monitored)
- [What does network detection miss if a segment is not mirrored?](https://netsenx.com/en/faq/what-does-network-detection-miss-if-a-segment-is-not-mirrored)
- [What should an incident log contain for a NIS2 audit?](https://netsenx.com/en/faq/what-should-an-incident-log-contain-for-a-nis2-audit)
- [How do we show an auditor what we decided on each security alert?](https://netsenx.com/en/faq/how-do-we-show-an-auditor-what-we-decided-on-each-alert)
- [How long must we keep security incident records?](https://netsenx.com/en/faq/how-long-must-we-keep-security-incident-records)