CC7.2: Monitoring and logging
CC7.2 fails when the logs are off, unprotected, or unwatched. Deixic turns them on, protects them, and never deletes or shortens one.
What CC7.2 asks
CC7.2 asks that the company watch its systems for events that indicate an attack or a failure, and keep the records to investigate them.
The auditor checks that audit logs exist in every region and account, that nobody can alter them, and that alerts exist for the events your policy names.
Source: AICPA Trust Services Criteria (2017, with revised points of focus 2022). This page paraphrases the criterion.
Tests that fail, and what Deixic does
Each row is a test from your compliance platform and the change Deixic makes in the connected system.
| Failing test | What Deixic does | Authority |
|---|---|---|
| CloudTrail log file validation is enabledAWS | Turns log file validation on and makes the organization trail multi-region. | Runs under written policy |
| Audit logs are enabled for all servicesGCP | Enables Data Access audit logs for IAM and storage. Logging more services raises the bill, so an approver confirms the list. | Waits for a named approver |
| Log retention meets policyAWS, GCP | Lengthens CloudWatch and log bucket retention to the period in your policy. Deixic never shortens retention. | Runs under written policy |
| Alerts exist for root use and unauthorized API callsAWS, Google Workspace | Creates the metric filters and alarms in AWS and turns on the Google Workspace alert rules for suspicious sign-ins and admin changes. | Runs under written policy |
| Alerts reach a personAWS, Slack | Asks you which person or Slack channel receives each alert. | Goes to you as a decision |
What waits, and what Deixic refuses
Approvals name a person and record a reason. Decisions are actions outside the authority your policy grants.
Waits for a named approver
- Enabling audit log categories that add storage cost.
- Sending logs to a new storage location or account.
Never run without your decision
- Deleting, disabling, or shortening retention on any trail or log. Deixic refuses.
- Who receives each alert.
- Suppressing an alert that fires often.
What Deixic reads back
After each change Deixic reads the setting from the system itself.
| System | Read back |
|---|---|
| AWS | Trail status: validation on, multi-region on, and the regions and accounts it covers. |
| GCP | The audit log configuration as stored on the project or organization. |
| AWS | Retention in days on each log group, and each alarm's state. |
Evidence your auditor receives
One signed, hash-linked receipt per change, exported as PDF, HTML, or JSON.
- Trail and log configuration before and after
- Regions and accounts covered
- Retention period against the policy section
- The alert list with its recipients
- Approver and reason for cost-bearing log changes
- The re-run result of the test in your compliance platform