An audit trail shows how the system is being used from day to day. Logs shall be retained for a period. In most cases, the type of business will define the external requirements for information retention. Legal counsel and audit staff should always be included in the development process for any data retention policies to ensure the business is complying with all contracts, local laws, industry regulations, and national or international laws.
For instance, the Sarbanes-Oxley Act (SOX) that affects US Corporations specifies retaining audit logs for up to seven years. The VISA Cardholder Information Security Program (CISP) specifies retaining audit logs for at least six months.
Some organisations retain audit logs until it is determined that they are no longer needed for administrative, legal, audit, evidence or other operational purposes. Some choose to retain all evidence for months or years after the incident ends. As a general guideline on information security, you may consider to keep the logs for six months or more. The following documents may be useful for your reference: |
