Home > Storage > PowerScale (Isilon) > Product Documentation > Security and Compliance > Dell PowerScale: SmartLock Best Practices > Compliance mode
SmartLock Compliance mode is designed only for users who are required to preserve critical electronic records to comply with the United States Securities and Exchange Commission’s (SEC) rule 17a-4(f). This rule relates to the electronic storage of broker-dealer records. The level of security required by rule 17a-4(f) is so stringent that not even administrators should be allowed to modify or delete WORM compliance data.
In Compliance mode, compliance directories are created for WORM data that must be protected in compliance with SEC rule 17a-4(f). The compliance clock governs the compliance directories. As mentioned previously, you cannot modify the compliance clock.
Table 1 shows what type of directories and files (data) can be created in each of the cluster modes.
Enterprise mode | Compliance mode | |
Regular (non-SmartLock) directories | Yes | Yes |
Enterprise directories (governed by system clock) | Yes | Yes |
Compliance directories (governed by compliance clock) | No | Yes |
Note: Both SmartLock cluster modes (Enterprise and Compliance) also support the creation of standard or regular directories and files that are not subjected to retention requirements.
Compliance mode disables root (superuser) access to the cluster in all circumstances. Superusers (UserID 0) are unable to log in, including in single-user mode. Instead of allowing root user access, clusters operating in Compliance mode have a compadmin administrator account. This account allows administrators to run some commands with root privileges through sudo. The /usr/local/etc/sudoers file specifies these commands. Also, all commands that are not Role Based Access Control (RBAC) commands must use sudo. To see which RBAC commands are in the current version of OneFS, run isi -h and look for commands without an asterisk next to them. You can use these commands through compadmin without sudo.
Operations that cannot be performed in Compliance mode are as follows:
Table 2 summarizes the differences between features for enterprise and compliance SmartLock directories:
Feature | Enterprise directories | Compliance directories |
Customizable file-retention dates | Yes | Yes |
Protection from modification after commit | Yes | Yes |
SEC 17a-4(f)-compliant file retention | No | Yes |
Privileged delete | On | Off | Disabled | Disabled |
Tamper-proof compliance clock | No | Yes |
Superuser (root) account | Yes | Not available |
Sudo-based cluster admin account (compadmin) | No | Yes |
Note: In Enterprise mode, the privileged delete capability remains available and configurable. It is Off by default, and you can turn it On for enterprise directories. You may also permanently disable this capability for enterprise directories to protect data from deletion or modification. In Compliance mode, it is disabled by default for compliance directories.
Table 3 summarizes the difference between the SmartLock modes.
Enterprise mode | Compliance mode |
Governed by a single system clock. | Governed by two clocks: system clock and compliance clock. |
Data written to enterprise SmartLock directories is committed to WORM state only for the specified retention period. The WORM state file can have the privileged delete capability within retention period when the privileged delete feature is enabled. | Data written to compliance SmartLock directories, when committed, can never be altered. |
Superuser access (root access) is maintained with full administrative control. | Superuser access is disabled. |