Management / Logging / Controls / v2026.11
Enforce Data Retention Policy for Logs
CCC.Logging.CN02 · Observability
Ensure that the retention period configured for logs aligns with the organization's data retention policy.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Core.CP32 | Deletion Protection | The service may be configured to block the deletion of a child resource, or to retain a deleted child resource for a recovery window during which it can be restored. |
| CCC.Core.CP34 | Data Lifecycle Policy | The service may be configured to automatically delete, archive, or transition data or child resources once a user-defined age or condition is reached. |
Related Threats
| ID | Title | Description |
|---|
| CCC.Logging.TH05 | Logs are Deleted Early or Retained Beyond Policy | Log data is deleted prematurely or retained longer than legally required due to misconfigured retention policies or manual overrides. This can lead to non-compliance with regulatory requirements or loss of critical forensic evidence, reducing the availability of the audit trail and the confidentiality of data that should no longer exist. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.Logging.CN02.AR01 | When a new log bucket or stream is created, its retention policy MUST be configured in accordance with organisation's data retention policy. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Logging.CN02.AR02 | When a query is performed to retrieve log events older than the number of days defined in the organisation's data retention policy, it MUST return an empty result. | tlp-clear, tlp-green, tlp-amber, tlp-red |