CyberGuard dictionary / Incident Response
Log Retention
Log retention is the policy and practice of keeping event records for a defined period so they remain available for operations, investigations, and obligations.
In simple terms
A log that disappears before an incident is discovered cannot help reconstruct what happened. Keeping every event forever also creates cost and privacy issues.
Technical explanation
A retention plan defines which logs are collected, storage duration, access controls, integrity protection, searchability, and disposal. Requirements vary by system, contract, and law; retention is distinct from merely enabling logging.
The retention window should be long enough for likely detection delays and investigation needs, while respecting privacy and contractual limits. Logs also need integrity and searchability, not just storage.
Examples in practice
A company keeps identity sign-in logs long enough to investigate delayed account compromise, then deletes them under its approved schedule.
A compromise is discovered sixty days after the first suspicious login. Because identity logs are retained for ninety days, investigators can build the timeline and identify affected accounts.
Why it matters
Appropriate retention makes incident timelines possible while controlling storage and data exposure.
VERIFY & LEARN MORE
Sources and further reading
- csrc.nist.govhttps://csrc.nist.gov/pubs/sp/800/92/final↗
- csrc.nist.govhttps://csrc.nist.gov/pubs/sp/800/61/r3/final↗
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.