Skip to main content

CCC.AuditLog.CN05: Export Audit Logs To Bucket

Control ID:CCC.AuditLog.CN05
Title:Export Audit Logs To Bucket
Objective:Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.
Control Family:
Availability

Related Threats

IDTitleDescriptionExternal MappingsCapability MappingsControl Mappings
CCC.Core.TH07Logs are Tampered With or DeletedTampering or deletion of service logs will reduce the system's ability to maintain an accurate record of events. Any actions that compromise the integrity of logs could disrupt system availability by disrupting monitoring, hindering forensic investigations, and reducing the accuracy of audit trails.
1
1
0

Related Capabilities

IDTitleDescription
CCC.Core.CP03Access Log PublicationThe service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors.
CCC.Core.CP10Log PublicationThe service automatically publishes structured, verbose records of activities, operations, or events that occur within the service.

Guideline Mappings

Reference IDEntry IDStrengthRemarks
NIST-CSF
PR.PS-04
0
-
NIST_800_53
AU-9
0
-
NIST_800_53
AU-11
0
-
NIST_800_53
AU-4
0
-

Assessment Requirements

IDDescriptionApplicability
CCC.AuditLog.CN05.AR01When audit logs are exported, then audit logs MUST be present in the configured data location.
tlp-red
tlp-amber