Log data is deleted prematurely or retained longer than legally required due to misconfigured retention policies or manual overrides. This can lead to non-compliance with regulatory requirements or loss of critical forensic evidence, reducing the availability of the audit trail and the confidentiality of data that should no longer exist.
Logs are Deleted Early or Retained Beyond Policy
CCC.Logging.TH05
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP32 | Deletion Protection | The service may be configured to block the deletion of a child resource, or to retain a deleted child resource for a recovery window during which it can be restored. |
| CCC.Core.CP34 | Data Lifecycle Policy | The service may be configured to automatically delete, archive, or transition data or child resources once a user-defined age or condition is reached. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Logging.CN02 | Enforce Data Retention Policy for Logs | Ensure that the retention period configured for logs aligns with the organization's data retention policy. |
| CCC.Logging.CN03 | Enable Object Lock On Log Bucket | Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity. |