I85PREP
⌘ K
DCAT study materials
DCAT study resources

The Compliance Audit and the Missing Logs

DCAT · Put your knowledge to work in context.

All case studies

The Compliance Audit and the Missing Logs

A data center operator is preparing for a compliance audit. The auditor requests 90 days of access-control logs for the server hall. The operator's badge system retains 30 days locally and archives to a cloud bucket, but the archive job has been failing silently for 6 weeks due to an expired API credential. The operator also discovers that two contractors were issued temporary badges 45 days ago that were never deactivated, and one badge was used to enter the hall 12 days ago at 02:14. The facility's CCTV retains 14 days of footage. The operator's policy says access logs must be retained 1 year and reviewed monthly.

1. Characterize the compliance failures and their severity, distinguishing what is recoverable from what is not.

Read the worked answer

Failures identified:

  1. Log retention failure (recoverable partially): 30 days local + 6 weeks of failed archive = roughly 30 days of logs are lost beyond the local window. The 90-day request cannot be fully met. Severity: high - it is a direct policy and audit violation, and the lost window may include the 02:14 entry's context.
  2. Stale contractor badges (recoverable): Two temporary badges active 45 days, never deactivated. Severity: high - an access-control gap; the 02:14 entry by a contractor badge is a potential unauthorized access.
  3. Missing monthly access review (process failure): If reviews were not happening, that is a governance failure. Severity: medium-high.
  4. CCTV retention (14 days): Cannot cover the 12-day-old event if it is within 14 days - actually 12 days is within 14, so footage may exist. Recoverable if pulled immediately.

Recoverable: CCTV for the 02:14 event (pull now before it ages out), current local logs, badge system records. Not recoverable: archived logs lost during the 6-week credential failure - unless the cloud bucket has partial data or the badge system has a secondary store.

2. What immediate actions do you take in the next 24 hours, and in what order?

Read the worked answer

Next 24 hours, in order:

  1. Preserve evidence - export and hash the current 30 days of local logs and pull the CCTV footage covering the 02:14 entry immediately (it ages out in 2 days). Chain-of-custody documentation.
  2. Deactivate the two contractor badges now and audit all temporary badges for expiry.
  3. Investigate the 02:14 entry - identify the badge holder, cross-reference with work orders, interview the contractor's supervisor, and review CCTV.
  4. Fix the archive credential and confirm the archive job runs; backfill from any secondary source (badge system may have its own DB backups).
  5. Notify - inform compliance/legal and, per policy, the auditor of the retention gap and the badge incident. Do not conceal it.
  6. Document everything with timestamps for the audit response.

Order rationale: Evidence preservation first (CCTV is time-critical), then containment (badges), then investigation, then remediation, then disclosure. Disclosure is not optional - concealing a known gap is worse than the gap itself.

3. What systemic controls would you recommend to prevent recurrence, and how would you verify they work?

Read the worked answer

Systemic controls:

  1. Credential expiry monitoring - alert when API credentials are within 14 days of expiry, and alert on archive-job failure (the silent failure was the root cause).
  2. Badge lifecycle automation - temporary badges auto-expire at a set date; a daily report of badges past expiry triggers deactivation.
  3. Monthly access review - automate the report and require sign-off; track completion as a metric.
  4. Log retention architecture - ensure the retention chain (local + archive) meets the 1-year policy with redundancy; test restore quarterly.
  5. CCTV retention alignment - extend to at least 30 days or align with policy.
  6. Silent-failure detection - any scheduled job that has not succeeded in 24 hours should page an operator.

Verification:

  • Run a tabletop restore test: can you produce 90-day-old logs on demand?
  • Audit a sample of temporary badges to confirm auto-expiry fired.
  • Confirm alerting by deliberately expiring a test credential and checking the alert fires.
  • Quarterly compliance drill with the auditor's checklist.

Metric: track "days of log retention available" and "expired badges active" as dashboard KPIs.