Auditability measures whether data access, modifications, deletions, and control operations can be recorded and examined for verification, incident response, or compliance. In a lakehouse, it is a storage trust-boundary requirement and an ingestion-design concern. section 5.1.2 section 6.1
A practical auditability design should:
- Log access attempts, changes, and deletions with enough granularity to detect anomalous behavior and support forensic investigations. section 5.1.2
- Retain audit trails according to organizational policy or legal requirements, especially for regulated and sensitive data. section 5.5.2
- Evaluate auditability alongside access control, encryption, reliability, and ingestion constraints rather than treating it as an afterthought. section 5.5.2 section 6.1
Regulated healthcare lakehouse
A healthcare analytics firm using Iceberg tables retains audit trails for patient-data access and modifications while combining tight access control and encryption at rest. section 5.5.2
Figure 5.2 Factors to consider when analyzing a storage layer’s security
Use the security-factor diagram to compare audit logging with identity integration, encryption, key management, and compliance constraints. section 5.1.2
