Log completeness
Every Event commits to the previous Event’s hash, and hourly published roots let anyone prove the log complete.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC2.1 | The entity obtains or generates and uses relevant, quality information to support internal control. |
| SOC2 CC7.2 | The entity monitors system components for anomalies that indicate malicious acts, natural disasters or errors. |
| ISO27001 A.8.15 | Logs of activities, exceptions, faults and other relevant events are produced, stored, protected and analyzed. |
| ISO27001 A.5.28 | Records of information security events are identified, collected and preserved for later use. |
| HIPAA 164.312(b) | Mechanisms record and examine activity in systems that hold electronic protected health information. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Event in each namespace, by sequence number, across the report period. |
| Assert | Sequence numbers are contiguous, each hash chains to its predecessor, and each hourly root recomputes and matches the witness copy. |
Owner
Compliance Officer, Legal Team.
Example
An auditor downloads a week of a payroll-data API's Events. Sequence numbers run unbroken, each hash chains to the last, and every hourly root matches the witness copy.