Auditor Evidence, Immutability, and Legal Hold in a Healthcare Cluster
A healthcare provider runs a three-node Cohesity cluster of 250 TB usable protecting 600 VMs, 1,100 Microsoft 365 mailboxes, and several clinical file shares. HIPAA requires six years of retention for certain records, and the organization has standardized on seven years. Fourteen legal holds are active, including two related to a billing investigation. Backups are archived to Azure with customer-managed keys. Local retention is 90 days, archive retention is seven years, but DataLock is not enabled. Twelve administrators hold Super Admin, SSO is not configured, and audit logs are not forwarded to the SIEM. An auditor asks for evidence that archived backups cannot be altered, that access is least privilege, and that legal-hold data will not expire. The security team wants to enable DataLock immediately on all existing archives. The cluster is 64% full, and the archive repository is in the same Azure subscription as production.
1. How should the team respond to the auditor's three evidence requests? Include specific control changes and the evidence to produce.
Read the worked answer
The auditor is asking three different questions: immutability, authorization, and retention override. Treat each separately.
Immutability: DataLock is not enabled, so the team cannot yet claim that archived backups are WORM-protected. Enable DataLock on the archive repository with a retention period that covers the seven-year requirement, and test that even a Super Admin cannot delete or shorten the retention. Produce a configuration report, a failed deletion test, and the archive policy showing the lock period. Customer-managed keys are useful but do not by themselves prove immutability.
Least privilege: twelve Super Admins is not least privilege. Build an RBAC matrix: backup operators, restore operators, audit viewers, and a small break-glass group. Integrate SSO and enforce MFA. Remove standing Super Admin from daily accounts. Produce the role assignment report, SSO configuration, and an access review signed by the security owner.
Legal hold and retention: show that the 14 holds are mapped to specific backup sets and that retention will not expire them. If the platform supports a legal-hold flag, apply it and produce the hold report. If not, extend retention beyond the hold end date and document the manual control. Produce the retention policy, hold register, and a restore test from a held dataset.
Finally, forward audit logs to the SIEM and retain them. The auditor will ask who accessed or tried to delete held data.
2. What is the risk of enabling DataLock on all existing archives immediately, and how should rollout be sequenced?
Read the worked answer
Immediate organization-wide DataLock is risky because immutability cuts both ways. If the retention period is set too long or applied to the wrong data, the organization cannot delete archives that contain inaccurate, duplicated, or legally expiring data. A mistaken lock on test data or on a dataset with a short legal requirement can create cost and compliance problems. There is also operational risk: a misconfigured lock can prevent normal retention expiry and fill the archive repository.
Sequence the rollout:
- Classify data: identify which archives are subject to HIPAA seven-year retention, which are under legal hold, and which are operational. Do not lock everything to the longest period by default.
- Pilot: enable DataLock on a small, well-understood archive set with a retention period that matches policy. Test deletion attempts, retention extension, and restore.
- Validate legal holds: confirm that the two billing-investigation holds are covered before locking, and that hold release will not accidentally delete data that must be retained for another reason.
- Expand by policy: apply DataLock through archive policies rather than manually per job, so new archives inherit the control.
- Document exceptions: record any archive that cannot be locked and the compensating control.
The security team's urgency is understandable, but a lock is not a substitute for classification. The goal is provable immutability for the data that requires it, not irreversible retention of everything.
3. How should legal hold interact with the seven-year retention policy, and what happens when a hold is released?
Read the worked answer
Legal hold and retention are different controls. Retention says how long data must be kept under normal policy; legal hold says data must be preserved because of anticipated or active litigation, even if normal retention would otherwise expire it. The longer of the two controls.
For the 14 active holds, the team should identify the custodians, date ranges, and data sources covered. Apply the hold at the narrowest scope that satisfies counsel, and verify that it overrides normal expiration. If the platform has a native legal-hold feature, use it and produce the hold report. If it does not, extend retention on the specific backup sets and document the manual process, including who can release the hold.
When a hold is released, do not delete immediately. First confirm in writing that counsel has released the hold and that no other hold, retention obligation, or investigation applies. Then return the data to normal retention. If the normal retention period has already passed, the data may become eligible for deletion at the next policy cycle; if the seven-year HIPAA retention still applies, it remains until that period ends. Record the release, the approver, and the resulting retention state. The auditor's concern is not only that held data is preserved, but that release is controlled and auditable.