Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.
Enable Object Lock On Log Bucket
CCC.Logging.CN03 · Observability
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP03 | Access Log Publication | The service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors. |
| CCC.Core.CP10 | Log Publication | The service automatically publishes structured, verbose records of activities, operations, or events that occur within the service. |
| CCC.Core.CP11 | Backup | The service can generate copies of its data or configurations in the form of automated backups, snapshot-based backups, or incremental backups. |
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
| CCC.Core.CP32 | Deletion Protection | The service may be configured to block the deletion of a child resource, or to retain a deleted child resource for a recovery window during which it can be restored. |
| CCC.Core.CP34 | Data Lifecycle Policy | The service may be configured to automatically delete, archive, or transition data or child resources once a user-defined age or condition is reached. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Core.TH07 | Logs are Tampered With or Deleted | Tampering or deletion of service logs will reduce the system's ability to maintain an accurate record of events. Any actions that compromise the integrity of logs could disrupt system availability by disrupting monitoring, hindering forensic investigations, and reducing the accuracy of audit trails. |
| CCC.Core.TH06 | Data is Lost or Corrupted | Services that rely on accurate data are susceptible to disruption in the event of data loss or corruption. Any actions that lead to the unintended deletion, alteration, or limited access to data can impact the availability of the service and the system it is part of. |
| CCC.Logging.TH05 | Logs are Deleted Early or Retained Beyond Policy | Log data is deleted prematurely or retained longer than legally required due to misconfigured retention policies or manual overrides. This can lead to non-compliance with regulatory requirements or loss of critical forensic evidence, reducing the availability of the audit trail and the confidentiality of data that should no longer exist. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.Logging.CN03.AR01 | When an attempt is made to modify or delete data before the object lock period expires, then the action MUST be denied. | tlp-red, tlp-amber |