AU-11—Audit Record Retention
LOW
MODERATE
HIGH
PRIVACY
>Control Description
Retain audit records for ⚙organization-defined time period consistent with records retention policy to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
>Control Enhancements(1)
>Cross-Framework Mappings
NIST CSF 2.0
via NIST CSF 2.0 Concept Crosswalk>Programmatic Queries
Beta
Related Services
CloudWatch Logs
S3 Lifecycle
Glacier
CLI Commands
Check log group retention
aws logs describe-log-groups --query 'logGroups[*].{Name:logGroupName,RetentionDays:retentionInDays}'Check S3 lifecycle rules
aws s3api get-bucket-lifecycle-configuration --bucket BUCKET_NAMEList Glacier vaults for archives
aws glacier list-vaults --account-id -Check CloudTrail retention
aws cloudtrail describe-trails --query 'trailList[*].{Name:Name,S3Bucket:S3BucketName}'>Supplemental Guidance
Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action.
The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.
>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of AU-11 (Audit Record Retention)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring AU-11?
- •How frequently is the AU-11 policy reviewed and updated, and what triggers policy changes?
- •What training or awareness programs ensure personnel understand their responsibilities related to AU-11?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce AU-11 requirements.
- •What automated tools, systems, or technologies are deployed to implement AU-11?
- •How is AU-11 integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce AU-11 requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of AU-11?
- •What audit logs, records, reports, or monitoring data validate AU-11 compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of AU-11 effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate AU-11 compliance?
Ask AI
Configure your API key to use AI features.