Controlspecificatie
Immutable audit event storage policy
Advanced Audit Logging
Immutable audit event storage policy defines an enforceable control requirement inside Advanced Audit Logging, with measurable checkpoints and operational constraints.
Doel
Enforce policy and runtime constraints tied to Advanced Audit Logging so drift and non-compliant operations are blocked early.
Scopecontext
Unified logging pipeline with policy-bound retention and evidence export.
Invoer
- Policy requirements and risk appetite definition
- System boundaries and affected components
- Exception handling workflow and escalation owner
Uitvoer
- Control implementation with enforceable policy condition
- Monitoring signal and alerting threshold
- Exception register entry with expiry and audit trace
Acceptatiecriteria
- Control blocks or flags non-compliant state changes
- Evidence is exportable for internal or external audit
- Exception path is time-bounded and explicitly approved
Compliance-bewijsnotities
- [nDSG] Control objective and test outcome recorded for assurance
- [DORA] Control objective and test outcome recorded for assurance
- [NIS2] Control objective and test outcome recorded for assurance
Specificatieschema
Eigenaarsrol
Security and Platform Governance Owner
Goedkeuringssign-off
Governance lead plus founder-level exception approval for bypasses
Versioneringsbeleid
Policy revision tags linked to deployment release ID
Reviewcadans
Bi-weekly control health review and quarterly deep audit
Bewijsretentie
Control test evidence retained for at least 18 months
Verplichte secties
- Control objective and policy statement
- Trigger conditions and enforcement mechanism
- Monitoring signals and alert thresholds
- Exception process with expiry policy
- Control test method and result capture format