“Are processes, procedures, and technical measures to ensure the logging infrastructure is "read-only" for all with write access (including privileged access roles) defined, implemented, and evaluated?”
Typical industry answer
Vendors typically answer "Yes" and cite a combination of: (1) audit logs written to a separate storage system (often S3 with Object Lock, GCS Bucket Lock, or Azure Immutable Blob), (2) IAM policies restricting which roles can write/delete, (3) periodic access reviews, (4) credential rotation. The answer satisfies the questionnaire because the controls listed are real and operational.
The gap that "Yes" doesn't close
A "Yes" answer here means the protection is policy-administered, not structurally enforced. Object Lock retention can be modified by an account owner with appropriate IAM permissions. The "privileged access roles" caveat in the question is doing critical work — these are exactly the roles that, by design, have administrative control over the logging system. The customer cannot independently verify whether a privileged role rewrote a log entry between two of their reads.
What changes with Unincorporated
The chain is cryptographically append-only by construction. Modifying any past entry mathematically breaks every entry chained after it; the break is detectable in a single verification pass. No privileged role — including the operator that runs Unincorporated — can silently rewrite history. The customer's compliance team verifies the integrity in their own browser via WASM. Protection is mathematical, not policy-administered.
Verify the pattern yourself