3.3.1 SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process
SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Examine log content fields · SIEM / log platform
- Test log creation across systems · SIEM / log platform
periodic reviewEvidence produced at each review
- Sample audit records · SIEM / log platform
governing documentDocuments that govern the control
- Logging policy with retention period · Policy repository / GRC workspace
- SIEM ingest list · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Cloud audit logs not retained
- Retention period inconsistent across systems
- Audit log integrity not assessed
- Gaps in log generation for critical events
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet3.2.1 Account data storage is kept to a minimum through implementation of data retention and disposal policies, procedures, and processes that include at least the following: • Coverage for all locations of stored account data. · 3.3.1.1 Full track data not stored after authorization