Log Retention
What is Log Retention?
Policies defining how long log data must be stored based on compliance requirements, security needs, and organizational policies.
Terms that appear alongside log retention
Each of these is named in at least one of the same controls as log retention. The number is how many controls name both.
- integrity 14 shared controls
- audit 12 shared controls
- nist 9 shared controls
- authentication 7 shared controls
- log management 6 shared controls
- audit trail 6 shared controls
- chain of custody 6 shared controls
- authorization 5 shared controls
Frameworks that govern log retention
What the standards actually require on log retention
Requirements naming log retention across 6 standards, quoted from the control text.
Providers must cooperate with cyberspace and other authorities' supervision and inspection, give explanations, retain relevant logs (records) for the period prescribed by law, and provide necessary technical/data support and assistance.
CN-ALG-A28 · Audit Cooperation and Log Retention →Operate log retention per NIST SP 800-92 Chapter 4 (Planning) Section 4.5 + Chapter 5 Operational Processes. Retention policy aligned to legal and regulatory requirements: document retention period per log category (security event logs + audit logs + access lo...
NISTSP92-6 · Log Retention: Policy, Tiered Storage, Backup, Secure Disposal, Legal Hold →The plan must require consistent criteria for the security boundaries that scope nonlocal access controls, management of every nonlocal access method and of access approvals, handling of consecutive authentication failures per the risk strategy, manual and aut...
api-1164::PR.AC-3 · PR.AC-3 Nonlocal access managed: boundaries, approvals, failed logons, session control, emergency access and log retention →Directions 5-7 establish the technical baseline for evidence preservation + forensic readiness + time integrity. Direction 5: All service providers + intermediaries + data centres + body corporates + government organisations shall mandatorily enable logs of al...
CERTIN-Logging-180DayRetention-IndiaLocalisation-NTP-NIC-NPL-CERTIn-Access-Dir5to7 · CERT-In Directions 5-7 System Logging + Clock Synchronization - 180-Day Log Retention in India + NTP Synchronisation with NIC/NPL + Log Availability to CERT-In on Order →Logs of failed logins, data file changes, policy and parameter changes and time server changes are kept for at least seven days; administrator activity logs for at least 30 days.
nevada-gaming-control-board-cybersecurity-requirements::MICS-IT-11 · IT MICS #11 Event log retention: seven days, 30 days for administrator logs →Agencies should set priorities for their log retention requirements according to the risks around their most sensitive systems.
new-zealand-information-security-manual-nzism::16.6.13.C.05 · 16.6.13.C.05 Prioritise log retention by sensitive-system risk →Questions people ask about log retention
What is Log Retention?
Why is Log Retention important for compliance?
Which compliance frameworks address Log Retention?
Where can I learn more about Log Retention?
See how Log Retention applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.