Detect · Established tier · Security Operations

DE-01Security logs are kept for the required period

Security logs are collected centrally and kept 365 days; transaction logs are kept 5 years.

Status

Gap

1 item contradicts the control.

Exposure

High

2 evidence items from 1 sources

CCSA · Detect

Foundational

This control blocks Established for the whole domain.

What the evidence shows

The core banking index keeps 180 days against 365. Retention was cut for licence headroom with no change record.

Remediation · Security Operations

Restore 365-day retention on cbs_app and backfill from cold archive, which is restorable to 400 days.

Root cause: Licence headroom. Log retention was cut to save licence volume, with no change record.

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-de01-1

Core banking index retention is 180 days (required: 365)

Splunk Enterprise · config · collected 4 h ago (Oct 15, 2026 · 09:59 UTC) · limit 48 h

Contradicts

Query: | rest /services/data/indexes/cbs_app | table title frozenTimePeriodInSecs
Identity: token svc-assurance (role assurance_ro, named indexes)
Collector: splunk-collector 3.0.1
Window: 24 h
Records: 1
SHA-256: 7b7579e607029213266434cf42c1581e47c875bbe0f4e244663f6d016b92d9f1

ev-de01-2

96% of in-scope log sources reported in the last 24 hours

Splunk Enterprise · telemetry · collected 4 h ago (Oct 15, 2026 · 09:59 UTC) · limit 48 h

Supports

Query: | tstats latest(_time) where index=* by host | where _time > relative_time(now(),"-24h")
Identity: token svc-assurance (role assurance_ro, named indexes)
Collector: splunk-collector 3.0.1
Window: 24 h
Records: 1,284
SHA-256: 788b264a1cb16dea48c05c727495ccd94b018ae183545dbf19fa55af7e6610b2