How long should you keep logs? AU-11 does not give a number. It gives a purpose, and it makes you choose.
NIST SP 800-53 Rev 5 binds US federal systems, and others through contract. For other organizations it is a reference.
What the control asks
Retain audit records for a time period you define to support after-the-fact investigations of incidents and to meet regulatory and organizational retention requirements. The enhancement AU-11.1 Long-term Retrieval Capability covers being able to retrieve old records.
NIST's guidance says to keep records until they are no longer needed for administrative, legal, audit or operational purposes, including legal requests such as subpoenas. It also says to develop standard categories of audit records and standard response processes for each. The National Archives schedules apply to US federal agencies only.
What it means in practice
Set a retention period by log category. Security and authentication logs often need longer than debug logs. Factor in contract terms, regulations that apply to you and how long incidents usually take to be found. Keep the period consistent with privacy commitments, since personal data in logs should not be kept forever.
Evidence to collect
- A retention schedule by log category with the reasoning.
- Storage lifecycle configuration that enforces it.
- Proof old records can be retrieved, such as a restore test.
- Legal hold procedure.
Common gaps
- Defaults from the logging tool, unreviewed.
- Retention shorter than the time it takes to detect a breach.
- Logs that exist but cannot be searched after archiving.
- No legal hold process.
How to implement it
Write the schedule, enforce it with lifecycle rules, test retrieval annually, and add a hold flag for investigations.
Quick check
Is there a required number of days?
Not in AU-11 itself. You define the period. Other rules that apply to you may set minimums.
