CIS-3.4 Enforce Data Retention

• T1070 Indicator Removal — Data Retention restricts, hardens against, or increases visibility into the adversary behavior. • T1070 Indicator Removal — This overarching technique covers deleting artifacts across an environment. CIS 3.4 protects the evidence chain by establishing mandatory retention periods that an attacker cannot alter or shorten. • T1070.003 Clear Command History — This sub-technique purges terminal histories like .bash_history or PowerShell logs. Data retention policies mandate logging shell commands directly to a central repository, preserving the operational history despite local terminal purges. • T1070.007 Clear Network Connection History and Configurations — This sub-technique wipes local network state data and active connection logs. Enforcing retention timelines on network telemetry ensures lateral movement records survive local configuration resets. • T1070.008 Clear Mailbox Data — This sub-technique permanently purges emails to hide phishing or exfiltration. CIS 3.4 requires a minimum retention window for email archives, blocking adversaries from destroying corporate messaging records. • T1070.009 Clear Persistence — This sub-technique removes scheduled tasks or registry keys after use. Retaining system modification logs according to enterprise timelines ensures the lifecycle of the persistence mechanism remains fully reviewable. • T1485 Data Destruction — Retention is protective because it limits the time window in which valuable data remains available for destruction, tampering, or cleanup by an attacker. • T1485 Data Destruction — Retention is protective because it limits the time window in which valuable data remains available for destruction, tampering, or cleanup by an attacker. Data retention policies protect against adversaries deleting logs by mandating strict storage lifecycles, off-site replication, and immutability. • T1685.005 Clear Windows Event Logs — This technique targets local Windows security and system event logs. Enforcing a minimum retention timeline ensures Windows event data is moved off-host and preserved, defeating local log-clearing attempts. • T1685.006 Clear Linux or Mac System Logs — This technique deletes critical Unix artifacts like /var/log system logs. Documented retention processes guarantee that Unix system trails are streamed to a repository where minimum storage timelines are strictly enforced.