Keep container scan evidence for as long as the image can still be deployed, plus the retention period your auditor, contracts or regulator require. We cannot name that number for you, so ask the auditor and write it down. The format matters as much as the duration: results must be tied to an image digest and a date.
What counts as evidence
A scan result becomes audit evidence when it can answer three questions later: which image, when, and what was done about it. A screenshot of a dashboard answers none of them reliably. Keep records with these fields.
- Image digest and the tags that pointed at it at the time.
- Scan date and the version of the scanner and its vulnerability data.
- Findings with severity, fix availability and status.
- Decision for each open finding: fixed, accepted with expiry, or not affected with reason.
- Who approved exceptions.
- The deployment record showing where the digest ran.
Retention by record type
| Record | Suggested retention | Reason |
|---|---|---|
| Scan result for a released or deployed digest | Image lifetime plus audit window | Shows what you knew at release |
| SBOM for the same digest | Same | Proves what the image contained |
| Exception and approval records | Audit window after expiry | Shows who accepted risk |
| Scan result for throwaway CI builds | Delete with the image | No release decision depended on it |
| Gate logs (pass or fail) | Audit window | Shows the control operated |
The "audit window" is whatever your framework period and your auditor ask for. A common pattern is to cover at least the full observation period of the report you are pursuing, but confirm that with the person doing the audit.
Avoid the two common mistakes
First, keeping only the latest scan. Overwriting history means you cannot show that a control operated in March when you are asked in October. Append results, do not replace them.
Second, keeping evidence in a place that dies with the image. If scan data lives only in the registry and the registry cleans up old images, the evidence disappears with them. Export scan records to a separate store with its own retention rule. See audit evidence retention for the general version.
Make it easy to produce
Evidence you cannot find in an hour will not help during an audit. Index by digest and by date, and test retrieval yourself once a quarter: pick a random release from six months ago and try to produce its scan, SBOM and exception record.
If privacy rules apply to anything in the records, such as engineer names in approvals, check the retention limits for that data too.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings map to framework controls, then ask which records an auditor would sample for each.
Where Safeguard fits
Safeguard supports compliance and evidence automation, collecting scan, SBOM and policy records per image so they can be retrieved by digest. Start with a free scan.
Quick check
Is the registry a good place to keep scan evidence?
Only if the registry retention matches the audit window. Otherwise export the records to a store with their own retention rule.
Do I need to keep scans for images we deleted?
If the image ever ran in production inside the audit window, keep its scan and SBOM records even after the image is gone.
Last reviewed: 19 October 2026.
