Ensure that log data can only be routed to sink or export destinations inside the organisation's defined trust perimeter, so that a misconfigured or compromised sink cannot deliver logs to an external party. Routing logs to a sink is not data replication, so this control is distinct from core CN10.
Restrict Log Sink Destinations to the Trust Perimeter
CCC.Logging.CN08 · Data Resilience
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP06 | Access Control | The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes. |
| CCC.Core.CP14 | API Access | The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE. |
| CCC.Core.CP22 | Location Lock-In | The service may be configured to restrict the deployment of child resources to specific geographic locations. |
| CCC.Logging.CP09 | Internal Sink | The service may be configured to continuously route log data to a storage bucket, data warehouse, or messaging child resource within the same cloud provider. |
| CCC.Logging.CP10 | External Sink | The service may be configured to route log events to an external SIEM or data analysis system outside the cloud platform. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Logging.TH02 | Log Data is Transferred Outside the Trust Boundary | Sensitive log data, including PII, financial transaction details, or system vulnerabilities, may be exfiltrated through the query or API interfaces by a compromised or over-privileged account, or routed out by a sink configured to deliver logs to a destination outside the trusted boundary. Log data leaves the organisation's control, compromising its confidentiality. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.Logging.CN08.AR01 | When a log sink or export destination outside the organisation's defined trust perimeter is created or modified, the service MUST deny the request. | tlp-green, tlp-amber, tlp-red |