| Component | Value |
|---|---|
| Audit bucket | gs://cytognosis-audit-7yr (us-central1) |
| Retention policy | 7 years (2,557 days) |
| Retention lock | ✅ LOCKED 2026-05-22 — irrevocable, HIPAA-compliant |
| Log sink (infra) | cytognosis-audit-7yr-sink in cytognosis-infrastructure |
| Log sink (phi-prod) | cytognosis-audit-7yr-sink in cytognosis-phi-prod |
| Logging SAs granted | service-517562623935@gcp-sa-logging.iam.gserviceaccount.com + phi-prod equivalent |
Compliance note: The retention lock was applied 2026-05-22 (4 days after the policy
was created, after confirming log flow). The lock is irrevocable — GCP will not allow
objects to be deleted or the retention period to be shortened under any circumstances.
This satisfies HIPAA 164.316(b)(2)(i) and HHS audit log guidance.
``bash`
gcloud storage buckets describe gs://cytognosis-audit-7yr \
--project=cytognosis-infrastructure \
--format="yaml(retentionPolicy)"Should show: isLocked: true
severity>=NOTICE OR logName=~"cloudaudit" OR logName=~"data_access"
`
Adding cytognosis-data Project (when provisioned)
`bash
gcloud logging sinks create cytognosis-audit-7yr-sink \
storage.googleapis.com/cytognosis-audit-7yr \
--project=cytognosis-data \
--log-filter='severity>=NOTICE OR logName=~"cloudaudit"'
Grant logging SA write access
gcloud storage buckets add-iam-policy-binding gs://cytognosis-audit-7yr \
--member="serviceAccount:service-@gcp-sa-logging.iam.gserviceaccount.com" \
--role="roles/storage.objectCreator"
``
Set up Cloud Monitoring alerts for anomalous activity (do when SCC is enabled):