Security log retention for regulators
Regulated businesses must keep certain records and security logs for a set period and be able to produce them on request. The periods come from the rules that apply to the business, and they differ by rule. This group covers how our team sets up retention, protection and retrieval so the logs exist when a regulator or auditor asks.
What we do
- Log source and rule mapping
- Retention settings per source
- Write-once copies
- Tamper and access monitoring
- Export and search testing
- Legal hold coordination
- Time source checks
- Periodic retention review
Our team works with Microsoft Purview Audit retention policies, Azure Monitor Log Analytics retention, AWS CloudTrail Lake and Google Cloud Logging buckets to hold logs for the configured period, with Amazon S3 Object Lock for write-once copies, and with NIST SP 800-92 as a reference for log management. We map each log source to the rule it serves, set retention and access, and test that a search and export works.
This works alongside our log pipeline, cloud audit and email archiving groups, and links to our Cybersecurity and Cloud Management services. Retention periods are taken from the customer's own legal or compliance advisers, not set by us, and this is not legal advice. These are tools and references our team has experience with, not partnerships.
Leading platforms we work with
- Microsoft Purview Audit retention policies
- Azure Monitor Log Analytics
- AWS CloudTrail Lake
- Google Cloud Logging
- Amazon S3 Object Lock
- NIST SP 800-92
Platforms and practices
- Log source inventory mapped to rules
- Retention schedule per log type
- Write-once storage for protected logs
- Access control and change logging on the log store
- Search and export test
- Legal hold hand-off
- Time synchronization check
- Annual retention review
References
- Microsoft Learn: Microsoft Purview audit log retention policies
- Microsoft Learn: Azure Monitor Log Analytics data retention
- AWS: CloudTrail Lake
- Google Cloud: Logging buckets
- AWS: Amazon S3 Object Lock
- NIST: SP 800-92, Guide to Computer Security Log Management
- eCFR: 45 CFR 164.316, HIPAA Security Rule policies and documentation
- eCFR: 17 CFR 240.17a-4, broker-dealer records
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Security log retention for regulators for clients
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow long do we have to keep security logs?
It depends on the rule that applies to your business, and the periods differ by rule. We do not set or state them for you. Check with your counsel or compliance adviser, then we configure retention to match their answer.
Can you tell us which retention period applies to us?
No. That is a legal or compliance decision, and this is not legal advice. We map each log source to the rule your advisers name, set retention and access, and test that a search and export works.
How do we show logs have not been altered?
We can keep write-once copies, limit who can change the log store, and log changes to it. Which logs need that protection is a question for your counsel or assessor.
What happens when a legal hold starts?
Your counsel decides what must be preserved. We hand off to that process: we identify the log sources involved and make sure normal deletion does not remove them while the hold is in place.