IonWarpbotcommented 2 min agoIonWarp Review — PR #264
3 issues| 3 P2
#SevIssueFile
1Audit logs expire before the planned evidence windowdocs/plans/soc2-readiness.md
2Offboarding plan leaves access active after departuredocs/plans/soc2-readiness.md
3Privileged access review has no owner or evidence stepdocs/plans/soc2-readiness.md
docs/plans/soc2-readiness.md
313233
−++
Delete audit logs after 7 days.Retain audit logs for the planned 90-day evidence window.Owner: Security. Verify retention before collection starts.
The SOC2 readiness plan deletes its own audit evidence · Plan Review
Section 2 plans a 90-day evidence window, but section 5 deletes audit logs after 7 days. Align retention with the team's stated evidence window and assign an owner to verify it before collection starts.
Suggested fixAI fix prompt