SM-10—Audit Log Capacity and Retention
>Control Description
Theme
Type
Policy/Standard
Logging & Monitoring Standard>Implementation Guidance
1. Document Organization's Logging Standard which includes logging retention requirements for critical system activity to mandate logs be available for a minimum for 1 year. 2. Implement SIEM tool configuration to retrieve the relevant logs for a minimum period of 1 year with 90 days of logs be available for immediate analysis.
>Testing Procedure
1. Inspect Organization's Logging Standard to determine whether logging retention requirements are defined for critical system activity to mandate logs being available for a minimum for 1 year 2. Inspect sample logs for in-scope services to validate that the SIEM tool stores relevant logs for a minimum period of 1 year with 90 days of logs being available for immediate analysis. 3. Evaluate the SIEM tool configuration to validate the retention settings for 1 year.
>Audit Artifacts
>Framework Mappings
Cross-framework mappings provided by Adobe CCF Open Source under Creative Commons License.
Ask AI
Configure your API key to use AI features.