Custos - System Administrator Logs and Privileged Access
Custos is the Fidem managed service that records, seals and retains the access of system administrators and suppliers, as required by the Italian Data Protection Authority’s provision on system administrators and by the NIS2 baseline measures. Logs are collected centrally, protected by a time-stamped cryptographic seal and remain verifiable during an inspection. MFA and a privileged access gateway reduce the risk before any evidence is needed.
System Administrator Logs: What the Rules Require
The Italian Data Protection Authority’s provision of 27 November 2008 on system administrators is fully in force: the GDPR did not absorb it. It requires administrators to be appointed individually, a list of them to be kept, their activity to be reviewed at least once a year and their logical access to be recorded with logs that are complete, unalterable and verifiable in their integrity, retained for at least six months.
NIS2, transposed in Italy by Legislative Decree 138/2024, raises the bar. The baseline measures defined by ACN require logging remote access and access with administrative privileges, collecting logs centrally and securely, defining and documenting retention times and procedures, protecting remote and administrative access with MFA and keeping administrative accounts separate from ordinary ones.
In practice, logs often stay on the very systems managed by the people whose actions they should record, cloud consoles keep them for only a few weeks, nobody reads them again and, when an inspection comes, nobody can prove they have not been touched. Custos was created to close this gap between what the rules require and what can actually be proven.
Record, Seal, Prove, Prevent
Completeness
Record
Successful and failed logins, use of privileges, changes to administrative accounts and groups, clearing of logs and changes to audit policies: who, when, on which system, with what outcome. Servers and domain controllers, firewalls, hypervisors, security consoles and cloud platforms such as Microsoft 365 and Google Workspace, with clocks synchronized to a reliable time source.
Immutability
Seal
The collected logs are closed into segments linked by a chain of cryptographic hashes and certified with RFC 3161 timestamps. Sealing always happens at a point that the client’s administrators do not manage: nobody can rewrite their own history without it showing.
Evidence
Retain and prove
Retention for a defined and documented period, beyond the legal minimum, with replicated copies. In an inspection you hand over a signed and time-stamped evidence package, together with a tool that lets anyone verify its integrity independently, without having to trust Fidem.
Prevention
Reduce the risk
Recording is not enough: privileged access also has to be protected. Custos adds multi-factor authentication on administrative and remote access and a mandatory checkpoint for privileged sessions, with approval and recording of supplier sessions and separate administrative accounts.
Four Modules, One Always Included
Custos is made up of four modules. The first is always included; the others are added based on what is missing, not on what can be sold.
Always included
Log Audit
Log collection from every system in scope, sealing and timestamping, retention with replication, alerts, periodic reports and the inspection package. It includes the log management procedures and the retention policy document. It can also be activated on its own and is the direct answer to the NIS2 measure on access logging.
Administrative and remote access
Administrative MFA
Multi-factor authentication on firewall administration interfaces, on the VPN and on administrative email and collaboration accounts, using the native features of the products the client already uses and its identity system. With a documented authentication procedure.
Administrators and suppliers
Privileged Access (PAM)
An on-site gateway becomes the mandatory checkpoint for administrative sessions: MFA, approval of supplier sessions and their recording, separate administrative accounts, unique and rotated local passwords, a list of remotely accessible systems and remote access procedures.
Only if missing
Administrator Documentation
Individual appointments of system administrators, the list, the notice and the paragraph of the IT policy, the annual review procedure. Offered only to those who do not have it already: if appointments and policy already exist from a NIS2 or GDPR project, we do not redo them.
Three Deployment Models
The same service adapts to three deployment models, chosen according to where the client wants its logs to be. In all three, the seal stays outside the control of the client’s administrators.
Everything on site
On-premises
Collection, analysis and archive run in the client’s data center, on an encrypted system administered only by Fidem that unlocks automatically only inside the authorized network. The SOC receives only the cryptographic hashes of the logs, with no personal data. It is the model for those who cannot let logs leave their infrastructure; with a single site, resilience depends on the client’s infrastructure and we state this at the design stage.
On site and at the SOC
Hybrid
Search and dashboards stay on site for the internal IT team’s daily work, while logs flow continuously to the Fidem SOC, where sealing and retention take place. It combines real segregation and resilience in both directions: if one side stops, the other keeps the data.
Standard model
Centralized at the SOC
Only the collection point and, where included, the privileged access gateway stay on site. Everything else lives at the SOC in an environment dedicated to the client. It is the model with the lightest footprint and the sharpest separation between those who administer the systems and those who keep the logs.
For companies without on-site servers, working entirely on Microsoft 365 or Google Workspace, there is a cloud-first variant: administrative and access logs are acquired directly from the cloud platforms, with nothing installed at the company.
How Log Immutability Is Guaranteed
Immutability is not a generic promise but a sequence of verifiable steps, the same in every deployment model.
Collection
Events arrive from the client’s systems with synchronized time and a local queue that does not lose data if the network goes down. Output: a complete, ordered stream.
Seal
Logs are closed into segments, each linked to the previous one by a cryptographic hash: removing or changing a line breaks the chain. Output: an integrity chain.
Timestamp
Each segment is certified with an RFC 3161 timestamp; on request, with an eIDAS qualified timestamp. Output: a certain date.
Verification
Replicated archive, periodic chain checks and an independent verification tool delivered with the inspection package. Output: demonstrable evidence.
What happens before collection is detectable and attributable
No technology can stop an administrator from switching off auditing on a system before the logs are collected. Custos makes sure it happens in the open: clearing a log, changing an audit policy or a source that stops sending all raise an alert, attributed to the person and the moment. We say it this way, without promising more.
Alerts, Reports and Inspections
The Fidem SOC watches the alerts that really matter for system administrators: cleared logs, changed audit policies, silent sources, changes to privileged groups, access outside the usual patterns. Every month the client receives a report on privileged access; every quarter an account review; every year the report that supports the review of administrators’ activity required by the Italian Data Protection Authority.
The client consults its own logs from a read-only portal or a local dashboard, depending on the model. When an ACN or Data Protection Authority inspection arrives, it receives a ready evidence package: sealed logs, hash manifest, timestamps and verification instructions.
Session Recording and the Italian Workers' Statute
Recording access and recording sessions are two different things, including under the Italian Workers’ Statute. The access log is a work tool under Art. 4, paragraph 2: an adequate notice is enough. Video recording of employees’ sessions instead falls under paragraph 1 and requires an agreement with the trade union representatives or the authorization of the Labor Inspectorate.
For this reason, in Custos session recording is active for external suppliers, with a notice and a contract clause, and off for employees until the Art. 4 procedure has been documented. Access and administration events are collected, never the content of the work nor mailbox metadata.
Regulations, Standards and Certifications
Custos meets the Italian Data Protection Authority’s provision on system administrators of 27/11/2008, the integrity, accountability and security principles of the GDPR (Arts. 5, 24 and 32) and the NIS2 baseline measures of ACN Determination 379907/2025: logging and central collection of access (PR.PS-04), multi-factor authentication (PR.AA-03), separate administrative accounts (PR.AA-05), account inventory (PR.AA-01) and documented remote access (PR.IR-01). Timestamps follow the RFC 3161 standard; a qualified timestamp carries the presumption of accuracy provided by Art. 41 of the eIDAS Regulation.
Fidem acts as a processor under Art. 28 and its technicians are appointed as system administrators at the client, with their own access logged in turn: those who keep the logs are subject to the same rules. Fidem is certified ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO 9001 and operates its own SOC in Italy.
Who It Is For
Custos is for every company that has system administrators, internal or external, and is therefore subject to the Italian Data Protection Authority’s provision. It is designed in particular for NIS2 entities, important and essential, that must put privileged access logging into operation, and for suppliers of NIS2 entities that must show their customers how they control their own staff’s access.
It suits companies with several sites and data centers, those with contractual or sector constraints that prevent logs from leaving, and those working entirely in the cloud with no on-site servers. For those who already have appointments and an IT policy, Custos builds on what is already there.
Delivered by the Fidem SOC, on the Defensio Platform
Custos is delivered by the Fidem SOC on the same platform as the Defensio ecosystem. For those who already have a Defensio Sensor on site, the log collection point can live on the sensor itself, with the secure link to the SOC already active.
Where NIS2 measures also require timely detection of security events on the internal network, Defensio monitoring works alongside Custos as a separate service: Custos documents who did what with privileges, Defensio watches what happens on the network.
Open, Verifiable, Step by Step
Custos is built on open technologies and documented standards, with no proprietary licenses to renew, and uses the security features already present in the client’s products: directory, firewall, email and collaboration platforms. Nothing needed to verify the logs depends on a closed format.
Activation starts from the critical sources, to put access logging into operation right away, then extends to all systems and finally to privileged access. At the end of the service the client receives the sealed archive with the manifest and the verification tool: the evidence stays theirs, even after the service ends.
Frequently Asked Questions about System Administrator Logs
Is the Italian Data Protection Authority's provision on system administrators still in force?
Yes. The provision of 27 November 2008 was not repealed by the GDPR, which does not regulate the role of system administrator. Individual appointment, the list, the annual review of activity and the logging of logical access therefore remain mandatory.
How long must system administrator logs be retained?
The Italian Data Protection Authority’s provision requires at least six months; the NIS2 measures require retention times to be defined and documented. Custos retains logs for a documented period longer than the legal minimum, with replicated and sealed copies.
Can a system administrator delete or change their own logs?
Not after collection: logs are sealed at a point the client’s administrators do not manage, and any change breaks the integrity chain. Before collection no technology can prevent it, but Custos detects the clearing of logs, changes to audit policies and silent sources, and attributes them to the person and the moment.
Is a union agreement needed to log administrators' access?
Not for the access log: it is a work tool under Art. 4, paragraph 2, of the Italian Workers’ Statute and an adequate notice is enough. Video recording employees’ sessions instead requires an agreement with the trade union representatives or the authorization of the Labor Inspectorate; for external suppliers a notice and a contract clause are enough.
Do our logs leave the company?
It depends on the model chosen. In the on-premises model the SOC receives only the cryptographic hashes, with no personal data; in the hybrid and centralized models logs are kept at the Fidem SOC in Italy, in a dedicated environment, with Fidem appointed as processor.
We already have administrator appointments and an IT policy: do we have to redo them?
No. The system administrator documentation is offered only to those who do not have it. If appointments, the list and the policy already exist, Custos builds on them and brings the technical part: collection, sealing, retention, alerts and reports.
Does it also work if we only use Microsoft 365 or Google Workspace?
Yes. In the cloud-first variant administrative and access logs are acquired directly from the cloud platforms, with nothing installed on site, and are sealed and retained as in all the other models.
Every Access Has a Name, Every Log Has Proof
Contact us to check together where you stand with system administrator logs and with the NIS2 measures on privileged access, and which Custos model fits your infrastructure.
Read more: NIS2 Compliance · GDPR Consulting · Data Protection Officer · Managed SOC · Certifications