Building SOX Evidence When the SIEM Has a Gap
A global retailer has 2,000 privileged accounts in 150 safes. The SIEM ingests Vault audit events and PSM recording metadata. Audit requests a quarterly SOX report of every password retrieval, including who approved it, with seven years of retention. The Vault audit safe is 80% full; the SIEM shows a 6-hour gap during a CPM upgrade. The PVWA Account Activity report returns only 30 days by default, and 22 users have Access without confirmation on production safes. The CISO wants evidence that no unapproved retrieval occurred. Security operations proposes enabling verbose audit on all platforms and increasing the audit safe size. The identity team says approvals are recorded in a separate ticketing system, not in the Vault.
1. Design the audit evidence pipeline and retention for the SOX report, including what to collect from Vault, CPM, PSM, and SIEM.
Read the worked answer
Build the evidence chain from source to report. Vault audit records authentication, authorization, retrieval, and safe changes; CPM logs record password changes and reconcile; PSM records session metadata and recordings; SIEM correlates them with approvals and identity. For SOX, collect the retrieval event, the user, the account, the time, the approval or dual-control confirmation, and the PSM session ID. Export from Vault and SIEM into immutable storage with hash or WORM retention for seven years, and reconcile counts between Vault and SIEM monthly. Do not rely on the default 30-day PVWA report as the system of record. Fix the 6-hour SIEM gap by backfilling from Vault audit and documenting the gap; then add buffering and a CPM upgrade log-forwarding check. The report should show both approved and unapproved attempts.
2. What would you do about the 22 users with Access without confirmation and the 6-hour SIEM gap?
Read the worked answer
For the 22 users with Access without confirmation, review each against role and account risk. Remove the permission from routine production safes and replace it with access request or dual control; keep a small break-glass group with alerting and monthly review. For the 6-hour SIEM gap, do not hide it: backfill from Vault audit, compare event counts, and issue an exception note with the root cause and remediation. If the gap occurred during a CPM upgrade, add a pre-upgrade syslog buffer check and a post-upgrade canary. The audit question is whether unapproved retrieval occurred, so the answer needs both the permission cleanup and the gap reconstruction, not just a promise to monitor more.
3. Evaluate the proposal to enable verbose audit on all platforms. What are the risks and alternatives?
Read the worked answer
Verbose audit everywhere is a blunt instrument. It increases log volume, storage cost, and SIEM noise, and it still may not capture approval context or PSM session linkage. Use risk-based auditing: full detail on high-risk safes and platforms, standard events elsewhere, and targeted collection for retrieval, dual-control confirmations, and safe-member changes. Test the event volume before enabling it broadly; if the SIEM cannot ingest it, you have created another gap. The better alternative is to fix the evidence pipeline, remove broad Access without confirmation, and retain the specific events the SOX report needs. Verbose logging is not a substitute for least privilege.