Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

au-11

audit record retention

assessment objective:

Determine if the organization:

au-11[1]

defines a time period to retain audit records that is consistent with records retention policy;

au-11[2]

retains audit records for the organization-defined time period consistent with records retention policy to:

au-11[2][a]

provide support for after-the-fact investigations of security incidents; and

au-11[2][b]

meet regulatory and organizational information retention requirements.

potential assessment methods and objects:

Examine: [select from: Audit and accountability policy; audit record retention policy and procedures; security plan; organization-defined retention period for audit records; audit record archives; audit logs; audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with audit record retention responsibilities; organizational personnel with information security responsibilities; system/network administrators].