Log Management Compliance - GPG 13 - Good Practice Guide 13

HMG organizations are required to follow Protective Monitoring for HMG ICT Systems, based on Communications-Electronic Security Group’s GPG 13 to gain access to UK GCSX, Government Connect Secure Extranet.

Standardizing IT forensics, incident response and management, and enterprise integrity are guidelines given as an audit trail of relevant security operations related to events on network. The 12 PMC, Protective Monitoring Controls, and audit situations within GPG 13 describe specific requirements that must be complied within everyday practice.

LogIT can simplify GPG 13 audits by giving direct address control obligations mandated. With the option to customize LogIT’s GPG 13 specific compliance module and reporting to your environment, our clients are empowered to build and maintain a secured compliance program. With case management, clients will be able to effortlessly conduct forensic investigations around incident response activity.

Check out Digital Edge’s Log Management Solution: LogIT, where you can learn how our unparalleled solutions can enforce continuous compliance. To assess your Log Management needs and budget your project, visit our Log Management Assessment tool for your instant quote!

To learn more about GPG 13 visit https://www.cesg.gov.uk/guidance/protective-monitoring-hmg-ict-systems-gpg-13.

If you feel that you need assistance from the Digital Edge Security team, please contact us at www.digitaledge.net/contact/.

Updated November 2026: the original post is kept above; the sections below add context for readers today.

What happened to GPG 13

GPG 13 was published by CESG, the information assurance arm of GCHQ. CESG became part of the UK National Cyber Security Centre (NCSC) in 2016, and the Good Practice Guides were later withdrawn. The NCSC now publishes logging and protective monitoring guidance in its Cyber Assessment Framework and its logging guidance for security purposes.

The core ideas of the twelve protective monitoring controls still apply: record the right events, keep accurate time, alert on suspicious activity and be able to investigate an incident from the records. See LogIT log management or estimate your plan with the log management assessment.