Audit log retention gap on payments service

CTRL-DP-188/PCI-DSS v4.0 Requirement 10, APRA CPS 234, and internal fraud investigation retention standard SEC-LOG-07.

Control statement

Security and audit logs for payment-processing systems must be retained online or readily retrievable for a minimum of 12 months, with at least the most recent 90 days immediately available for investigation and evidence production.

What the evidence shows

The log retention policy applied to the payments namespace specifies a 30-day delete action with no archive tier. Index lifecycle configuration in the observability platform confirms automated purge after day 30, and the fraud-case memo documents that investigators could not retrieve payment decision logs for a February 2025 dispute review.

Evidence artefacts

payments-log-retention-policy.yaml
observability-index-lifecycle-apr-2026.json
fraud-case-evidence-gap-memo.docx

Affected assets

1 payments microservice log stream and 12 index partitions

PressRto run·1–5for stages

Remediation Memory

2 similar past remediations found

100%Similarity
CTRL-DP-124·closed on 08 Mar 2026
Log retention policy extension across audit streams
Extended the observability index lifecycle from 30 days to 12 months for regulated audit streams, introduced a warm archive tier, and added retention policy linting to the platform pipeline.
- Same control domain: Data Protection
- Same severity: High
- Control ID family: CTRL-DP-
- Keyword overlap: audit, log, retention, payments, observability, index, lifecycle, archive
31 min · closed by James4 reusable artefacts
55%Similarity
CTRL-DP-089·closed on 22 Jan 2026
Encryption-at-rest remediation on archive databases
Enabled storage-level encryption with enterprise-managed KMS keys across the archive database cluster, rebuilt affected storage volumes, and added a Terraform module guardrail preventing unencrypted restores.
- Same control domain: Data Protection
- Same severity: High
- Control ID family: CTRL-DP-
45 min · closed by Evelyn4 reusable artefacts

Agent workspace

Click "Run remediation agent" to begin. The agent will diagnose the gap, plan the remediation, and ship the work in real time.