mon-10-eventlogretention.md

SCF - MON-10 - Event Log Retention

Mechanisms exist to retain event logs for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements.

Mapped framework controls

NIST 800-53

• AU-11

SOC 2

• C1.2

Control questions

Does the organization retain event logs for a time period consistent with records retention requirements to provide support for after-the-fact investigations of security incidents and to meet statutory, regulatory and contractual retention requirements?