Operate log retention per NIST SP 800-92 Chapter 4 (Planning) Section 4.5 + Chapter 5 Operational Processes. Retention policy aligned to legal and regulatory requirements: document retention period per log category (security event logs + audit logs + access logs + system logs + application logs + privacy event logs) matching the longest applicable obligation (regulatory + contractual + investigative + organisational policy). Online vs archive storage tiers: hot storage for incident response horizon (typically 30-90 days online) + warm for routine investigation (typically 1 year) + cold archive for long-term compliance (3+ years up to indefinite for some regulators) + balance cost + retrieval time + integrity guarantee per tier. Backup and recoverability of log data: replicate or back up logs to a separate facility or storage class + test recovery + measure RTO for log data + protect against ransomware and insider threats targeting log infrastructure. Secure disposal of logs at end of retention per NIST SP 800-88: apply Clear / Purge / Destroy methods per media type with documented chain of custody and Certificate of Sanitization. Legal hold and eDiscovery support: implement legal hold flagging that suspends scheduled disposal + supports eDiscovery review workflow + preserves chain of custody + integrates with legal case management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.