Operate log retention per NIST SP 800-92 Chapter 4 (Planning) Section 4.5 + Chapter 5 Operational Processes. Retention policy aligned to legal and regulatory requirements: document retention period per log category (security event logs + audit logs + access logs + system logs + application logs + privacy event logs) matching the longest applicable obligation (regulatory + contractual + investigative + organisational policy). Online vs archive storage tiers: hot storage for incident response horizon (typically 30-90 days online) + warm for routine investigation (typically 1 year) + cold archive for long-term compliance (3+ years up to indefinite for some regulators) + balance cost + retrieval time + integrity guarantee per tier. Backup and recoverability of log data: replicate or back up logs to a separate facility or storage class + test recovery + measure RTO for log data + protect against ransomware and insider threats targeting log infrastructure. Secure disposal of logs at end of retention per NIST SP 800-88: apply Clear / Purge / Destroy methods per media type with documented chain of custody and Certificate of Sanitization. Legal hold and eDiscovery support: implement legal hold flagging that suspends scheduled disposal + supports eDiscovery review workflow + preserves chain of custody + integrates with legal case management.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 59 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.