Retain Audit Logs
Description
Retain audit logs across enterprise assets for a minimum of 90 days.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
AI-driven SIEM with behavioral analytics, automated investigation, and SOAR capabilities for threat detection
Exabeam · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Historical Attack Evidence Destroyed by Premature Log Deletion
IntegrityLogs are retained for less than 90 days, and when a breach discovered months after initial compromise requires forensic investigation, the critical evidence from the initial intrusion and lateral movement phases has already been purged.
Compliance Violation from Insufficient Log Retention
AvailabilityRegulatory requirements mandate specific log retention periods (often 1-7 years), and insufficient retention results in compliance failures, audit findings, and potential penalties during regulatory examinations.
Vulnerabilities (When Safeguard Absent)
Log Retention Below 90-Day Minimum
Audit logs are retained for fewer than 90 days due to storage constraints or misconfigured rotation policies, destroying forensic evidence needed for incident investigations given the average breach detection time exceeds 200 days.
No Log Retention Policy Enforcement Mechanism
Even where retention policies exist on paper, no technical controls enforce minimum retention periods, allowing storage pressure or misconfigurations to silently purge logs before the required retention period expires.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |