Audit Logs Protection

[All Actors]
1. Encrypt all audit-log data at rest and in transit using industry-standard ciphers; manage keys in an approved KMS.

2. Define and automate retention and disposal policies that meet regulatory, contractual and business requirements.

3. Apply fine grained access control e.g., role- or attribute-based (RBAC/ABAC) and separation-of-duties so only authorised personnel or services can read, write, or delete logs.

4. Guarantee log integrity with tamper-evident controls (hashing, signing, immutability, etc.) and schedule periodic integrity checks.

5. Monitor and alert on log-access events and anomalies, forwarding alerts to the SOC / incident-response process.

6. Document log locations, protection controls and restoration procedures, and test recovery as part of DR / IR exercises.

1. Inquiring with Control Owners

1.1 Conduct interviews with personnel responsible for defining, implementing, and evaluating audit log security and retention processes for cloud infrastructure and AI processing services to understand their roles in protecting infrastructure logs and customer compute data. Verify their understanding of technical measures implemented to ensure audit logs from GPU/TPU resources, distributed computing environments, and customer workloads remain secure and are retained according to organizational requirements.

2. Inspecting Records and Documents

2.1 Verify that infrastructure logs, hypervisor logs, and customer compute session logs are stored in write-once or append-only formats where feasible.

2.2 Confirm that logs containing customer workload data, resource utilization metrics, and infrastructure access patterns are protected using encryption at rest and in transit.

2.3 Ensure access to infrastructure logs is restricted to authorized cloud operations personnel only, with RBAC or IAM controls maintaining customer data isolation.

2.4 Validate mechanisms to detect and alert on unauthorized access attempts or changes to logs containing customer infrastructure usage and performance data.

2.5 Check that cloud infrastructure log protection is periodically tested through internal audits, including validation of multi-tenancy security controls.

2.6 Confirm that log retention for cloud services aligns with customer contracts, regulatory requirements, and business policy requirements.

2.7 Verify that controls are in place to prevent unauthorized access to customer compute logs and maintain infrastructure security boundaries.

2.8 Review documented processes and procedures for cloud infrastructure audit log security, including breach notification and regulatory reporting procedures.

2.9 Validate that backup and recovery procedures exist for infrastructure audit logs to ensure operational continuity and customer service availability.

2.10 Confirm that log disposal procedures are secure and documented for infrastructure logs when retention periods expire, including customer data destruction verification.

2.11 Validate that logging services (e.g., CloudTrail, Audit Logs) enforce strict access policies and logging integrity.

2.12 Confirm logs cannot be disabled or modified without elevated administrative approval.

2.13 Ensure that encryption and integrity checks are applied to all logs in transit and at rest.

2.14 Verify segregation of duties to prevent unauthorized access or deletion of customer logs.

2.15 Confirm mechanisms exist to detect tampering or anomalies in the logging pipeline.

2.16 Check that CSP logs are regularly backed up and retained per compliance standards.

2.17 Ensure CSP logs support forensic investigations and comply with third-party audit requirements.

2.18 Validate that security incidents involving logging protection violations are promptly recorded and remediated.