Skip to main content

CCC.AuditLog.C05: Export Audit Logs To Bucket

Control ID:CCC.AuditLog.C05
Title:Export Audit Logs To Bucket
Objective:Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.
Control Family:
Availability

Related Threats

IDTitleDescriptionExternal MappingsCapability MappingsControl Mappings
CCC.Core.TH07Logs are Tampered With or DeletedTampering or deletion of service logs will reduce the system's ability to maintain an accurate record of events. Any actions that compromise the integrity of logs could disrupt system availability by disrupting monitoring, hindering forensic investigations, and reducing the accuracy of audit trails.
1
1
0

Related Capabilities

IDTitleDescription
CCC.Core.F03Access Log PublicationThe service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors.
CCC.Core.F10Log PublicationThe service automatically publishes structured, verbose records of activities, operations, or events that occur within the service.

Guideline Mappings

Reference IDEntry IDStrengthRemarks
NIST-CSF
PR.PS-04
0
-
NIST_800_53
AU-9
0
-
NIST_800_53
AU-11
0
-
NIST_800_53
AU-4
0
-

Assessment Requirements

IDDescriptionApplicability
CCC.AuditLog.C05.TR01When audit logs are exported, then audit logs MUST be present in the configured data location.
tlp-red
tlp-amber