Management / Logging / Controls / v2026.11
Restrict Field And Log Type Access
CCC.Logging.CN04 · Access Control
Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Logging.CP06 | Log Filtering and Transformation | The service may be configured to filter, normalise, and transform raw log data at ingestion to reduce storage volume and improve usability. |
| CCC.Logging.CP14 | Sensitive Data Masking | The service may be configured to detect sensitive data such as personal information, credentials, or tokens in log entries at ingestion and mask or redact it before storage. Not every provider offers this natively (GCP Cloud Logging has no ingestion-time masking). |
Related Threats
| ID | Title | Description |
|---|
| CCC.Logging.TH04 | Sensitive Data is Logged Without Masking | Sensitive data (e.g., PII, secrets, authentication tokens) is ingested into logs without proper anonymization, masking, or redaction at source or during ingestion. The sensitive values are stored in the log store and exposed to every user and sink with read access to those logs, compromising the confidentiality of the data. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.Logging.CN04.AR01 | When restricted fields are accessed by unauthorized users, then those fields MUST remain masked. | tlp-red, tlp-amber |