Logs are useless the day the disk fills and logging stops. AU-4 asks you to plan for that.
NIST SP 800-53 Rev 5 binds US federal systems and others by contract. Other organizations can use it as a reference.
What the control asks
Allocate audit log storage capacity to accommodate your defined audit log retention requirements. NIST's guidance says to consider the types of logging performed and the processing requirements, and notes that enough capacity lowers the chance of losing logging. The enhancement AU-4.1 Transfer to Alternate Storage covers moving logs to other storage.
What it means in practice
Estimate daily volume, multiply by retention, add growth and a margin. Then watch usage so you see trouble early. AU-5 covers what happens if logging fails anyway.
Evidence to collect
- A capacity calculation tied to retention.
- Storage quotas or lifecycle rules.
- Monitoring and alerts on log storage use.
- Evidence of logs moving to cheaper or alternate storage.
Common gaps
- Retention set but never costed.
- Hot storage filling because lifecycle rules were never configured.
- No alert until the pipeline stops.
How to implement it
Use object storage with lifecycle tiers, set alerts at a usage threshold, and review volume each quarter.
