AU-11—Audit Record Retention

LI-SaaS

Low

Moderate

High

>Control Description

Retain audit records for ⚙organization-defined time period consistent with records retention policy to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

>FedRAMP Baseline Requirements

Additional Requirements and Guidance

AU-11 Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements. AU-11 Requirement: The service provider must either provide a capability for agency customers to export event log files so the agency can comply with federal log storage requirements from M-21-31; or store event log data on behalf of agency customers and make them available to agency customers in compliance with M-21-31. This additional requirement should be automatically updated if M-21-31 is rescinded, updated, or replaced. AU-11 Guidance: The service provider is encouraged to align with M-21-31 where possible.

>Discussion

Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action.

The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.

>Cross-Framework Mappings

SCF

MON-10

Compare

>Programmatic Queries

Beta

Related Services

CloudWatch Logs

S3 Lifecycle

Glacier

CLI Commands

Check log group retention

aws logs describe-log-groups --query 'logGroups[*].{Name:logGroupName,RetentionDays:retentionInDays}'

Check S3 lifecycle rules

aws s3api get-bucket-lifecycle-configuration --bucket BUCKET_NAME

List Glacier vaults for archives

aws glacier list-vaults --account-id -

Check CloudTrail retention

aws cloudtrail describe-trails --query 'trailList[*].{Name:Name,S3Bucket:S3BucketName}'

Open AWS Console Documentation

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What formal policies and procedures govern the implementation of AU-11 (Audit Record Retention)?
•Who are the designated roles responsible for implementing, maintaining, and monitoring AU-11?
•How frequently is the AU-11 policy reviewed and updated, and what triggers policy changes?
•What training or awareness programs ensure personnel understand their responsibilities related to AU-11?

Technical Implementation:

•Describe the specific technical mechanisms or controls used to enforce AU-11 requirements.
•What automated tools, systems, or technologies are deployed to implement AU-11?
•How is AU-11 integrated into your system architecture and overall security posture?
•What configuration settings, parameters, or technical specifications enforce AU-11 requirements?

Evidence & Documentation:

•What documentation demonstrates the complete implementation of AU-11?
•What audit logs, records, reports, or monitoring data validate AU-11 compliance?
•Can you provide evidence of periodic reviews, assessments, or testing of AU-11 effectiveness?
•What artifacts would you present during a FedRAMP assessment to demonstrate AU-11 compliance?

Ask AI

Configure your API key to use AI features.