| CCC.Logging.CN01 | Centralized and Comprehensive Log Aggregation | Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service. | Observability | 1 | 3 | 3 |
| CCC.Logging.CN02 | Enforce Data Retention Policy for Logs | Ensure that the retention period configured for logs aligns with the organization's data retention policy. | Observability | 1 | 2 | 2 |
| CCC.Logging.CN03 | Enable Object Lock On Log Bucket | Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity. | Observability | 3 | 3 | 1 |
| CCC.Logging.CN04 | Restrict Field And Log Type Access | Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII. | Access Control | 1 | 6 | 1 |
| CCC.Logging.CN05 | Ensure Log Bucket is Not Publicly Accessible | Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. | Access Control | 2 | 3 | 2 |
| CCC.Logging.CN06 | Detect and Alert on Potential Log Exfiltration | Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data. | Observability | 1 | 5 | 1 |
| CCC.Logging.CN07 | Detect and Alert on Log Service Tampering | Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt. This extends the obligation of core CN16 to tlp-clear and tlp-green for this service, pending a WG decision on CN16's applicability. | Observability | 1 | 5 | 1 |
| CCC.Logging.CN08 | Restrict Log Sink Destinations to the Trust Perimeter | Ensure that log data can only be routed to sink or export destinations inside the organisation's defined trust perimeter, so that a misconfigured or compromised sink cannot deliver logs to an external party. Routing logs to a sink is not data replication, so this control is distinct from core CN10. | Data Resilience | 1 | 3 | 1 |
| CCC.Logging.CN09 | Alert on Log Ingestion Failure | Ensure that throttled, rejected, or silently missing log data is detected promptly, so that gaps in the audit trail are visible before they hinder detection or forensics. | Observability | 3 | 3 | 2 |
| CCC.Logging.CN10 | Preserve Log Entry Boundaries on Ingestion | Ensure that user-supplied content inside a log entry cannot create, split, or alter log records, so that injected control characters do not forge entries or disrupt downstream processing. | Ingestion | 1 | 1 | 1 |