thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Log Retention

Policy defining how long logs are stored, balancing investigation needs, compliance requirements and cost.

Definition

Retention periods derive from regulations (for example PCI DSS requires one year with three months immediately available), legal holds and incident investigation needs, given dwell times can be months. Hot, warm and cold storage tiers reduce cost. Logs should be protected for integrity.

Example

Keeping 90 days of SIEM data searchable and one year in archive storage to meet PCI DSS.

Exam tip

PCI DSS: retain audit logs at least 12 months, with 3 months immediately available.

Related terms