AU-11 Audit record retention
Requires audit records to be kept for an organization-defined retention period that is long enough to support after the fact investigation of incidents and to satisfy applicable regulatory and internal retention obligati
4
artefacts
3
held by a system
1
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Log platform retention configuration and archive tier settings · SIEM / log platform
- Evidence a record from the oldest retained period can still be produced and read · Policy repository / GRC workspace
- Reconciliation showing every in scope log source inherits the retention setting · SIEM / log platform
periodic reviewEvidence produced at each review
- Documented audit record retention period and the obligations that justify it · Data governance / DLP tooling
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Retention period set by storage cost rather than by investigative and regulatory need
- Hot search retention meets policy while archived records are unreadable or unrestorable
- Some log sources default to a short retention and were never brought into the policy
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAU-10 Non-repudiation. Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [organization-defined] · AU-12 Audit record generation