ComplianceNIST 800-53 control

NIST-AU-11 Audit Record Retention

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
AU Audit and Accountability
Control
AU-11

Control statement

Retain audit records for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Discussion

Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.

Related

Related control · Compliance (9)

  • NIST-AU-14 Session Audit NIST 800-53 control
  • NIST-AU-2 Event Logging NIST 800-53 control
  • NIST-AU-4 Audit Log Storage Capacity NIST 800-53 control
  • NIST-AU-5 Response to Audit Logging Process Failures NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-MP-6 Media Sanitization NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control

Referenced by Compliance · enhancement of (1)

  • NIST-AU-11(1) Long-term Retrieval Capability NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-AU Audit and Accountability NIST 800-53 family

Referenced by Compliance · related control (10)

  • NIST-AU-14 Session Audit NIST 800-53 control
  • NIST-AU-2 Event Logging NIST 800-53 control
  • NIST-AU-4 Audit Log Storage Capacity NIST 800-53 control
  • NIST-AU-5 Response to Audit Logging Process Failures NIST 800-53 control
  • NIST-AU-6(8) Full Text Analysis of Privileged Commands NIST 800-53 enhancement
  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-AU-9(7) Store on Component with Different Operating System NIST 800-53 enhancement
  • NIST-MP-6 Media Sanitization NIST 800-53 control
  • NIST-RA-5(8) Review Historic Audit Logs NIST 800-53 enhancement
  • NIST-SI-12 Information Management and Retention NIST 800-53 control