Logging and log retention requirements compared
Every major framework requires audit logs. Remarkably few say how long to keep them. Here is who sets a number, who doesn't, and how to choose one that satisfies all of them.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
Audit logging is close to universal: ten of the eleven frameworks we map require it (GDPR is the exception, and even there logs are how you investigate a breach). What they require differs in two ways: what to log and how long to keep it. The second is where teams most often get stuck, because only a few frameworks give a number.
Who requires what
| Framework | Logging & Audit | Link |
|---|---|---|
| NIST CSF 2.0 | PR.PS-04DE.AE-03 | Topic definition |
| ISO 27001 | A.8.15A.8.17 | Crosswalk |
| CIS v8.1 | CIS 8.2CIS 8.10CIS 3.14CIS 8.1CIS 8.3CIS 8.4CIS 8.5CIS 8.7CIS 8.8CIS 8.12 | Crosswalk |
| SOC 2 | CC7.2 | Editorial |
| PCI DSS | 10.2.110.3.210.5.110.6.1 | Crosswalk |
| CMMC | AU.L2-3.3.1AU.L2-3.3.2AU.L2-3.3.7 | Crosswalk |
| 800-53 | AU-2AU-3AU-11AU-12 | Crosswalk |
| HIPAA | §164.312(b) | Crosswalk |
| GDPR | — | No mapping in our data |
| NIS2 | 3.2 | Crosswalk |
| Essential Eight | ISM-1815ISM-1660ISM-1509ISM-1683ISM-1623 | Editorial |
Full detail and the reason for every link: Logging & Audit across frameworks →
What to log
The most specific frameworks list events. PCI DSS requires logs to capture individual user access to cardholder data, all administrative actions, access to the logs themselves, invalid access attempts, changes to identification and authentication credentials, starting and stopping of logging, and creation and deletion of system-level objects (10.2.1.1 to 10.2.1.7), each with user, type, time, outcome and origin (10.2.2). The CIS Controls add detailed, DNS, URL and command-line logs (8.5 to 8.8). SP 800-53 and CMMC require you to define the events you log (AU-2; AU.L2-3.3.1). ISO 27001 (A.8.15) and SOC 2 (CC7.2) require logging appropriate to your risks.
How long to keep logs
| Framework | Retention |
|---|---|
| PCI DSS | At least 12 months, with the last three months immediately available (10.5.1) |
| CIS Controls | At least 90 days (8.10) |
| SP 800-53 | A period you define (AU-11) |
| CMMC Level 2 | As long as needed to monitor, analyse, investigate and report (AU.L2-3.3.1) |
| ISO 27001, SOC 2 | Not specified; set by your risk assessment and legal obligations |
| HIPAA | Not specified for logs (the six-year rule covers documentation) |
Choosing a retention period
If PCI DSS applies to any part of your environment, 12 months with three months hot is the obvious baseline, and it comfortably satisfies the CIS minimum. For everyone else, it's a reasonable default too: long enough to investigate incidents discovered months after the fact, which many are, and short enough to store affordably. Adjust for law and contracts in your sector, and record the decision with its reasoning, which is what ISO and SOC 2 auditors will look for.
What to retain, not just how long
Retention periods apply to the logs that matter for investigation. A practical tiering:
- Security-relevant logs (authentication, privileged actions, firewall and EDR events, access to sensitive data): the full retention period, protected from change.
- Operational logs (application debug output, performance metrics): shorter retention, set by engineering need.
- Logs containing personal data: long enough for security, no longer than necessary, which keeps GDPR's storage limitation principle satisfied.
Write the tiers into your logging policy so the retention decision is visible and defensible.
Key takeaways
- Ten of eleven frameworks require audit logging.
- Only PCI DSS and CIS set retention periods.
- Twelve months, three immediately available, is a safe default.
- Protect logs from tampering and review security events; PCI DSS requires daily review.
Beyond retention
- Protect logs from tampering (PCI 10.3.2, CMMC AU.L2-3.3.8): write-once storage or a central log platform with restricted access.
- Synchronise clocks (PCI 10.6.1, CIS 8.4, CMMC AU.L2-3.3.7), or correlating events across systems fails.
- Review them: PCI requires daily review of security events (10.4.1); most others expect regular review, usually automated.
The Logging & Audit topic page lists every requirement with its source, and the related SIEM / SOC topic covers analysis. The gap analysis compares any two frameworks in full.
Questions
How long does PCI DSS require logs to be kept?
At least 12 months of audit log history, with the most recent three months immediately available for analysis (10.5.1).
Does HIPAA set a log retention period?
No. The Security Rule requires audit controls (§164.312(b)) but sets no log retention period. Its six-year retention requirement applies to required documentation such as policies, not to audit logs.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.