How to answer 'Are security audit logs protected against unauthorized modification or deletion?' on a SIG Lite
I. Reviewer Guidance & Pitfalls
Explain write-once-read-many (WORM) storage, IAM policies preventing log deletion even by administrators, and immutable S3 bucket lock policies.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · LOG-04
Security audit logs are stored in dedicated, isolated log buckets with Object Lock (WORM) enabled; IAM policies restrict all users and services from modifying or deleting audit trails (SOC 2, CC7.2).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default