>myctrl.tools
Preferences
Under active development — Content is continuously updated and improved
Compare

AU-11—Audit Record Retention

IL4 Mod
IL4 High
IL5
IL6

>Control Description

Retain audit records for ⚙organization-defined time period consistent with records retention policy to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

>DoD Impact Level Requirements

FedRAMP Parameter Values

AU-11 [a time period in compliance with M-21-31]

Additional Requirements and Guidance

AU-11 Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements. AU-11 Requirement: The service provider must support Agency requirements to comply with M-21-31 (https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf) AU-11 Guidance: The service provider is encouraged to align with M-21-31 where possible

>Discussion

Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action.

The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.

>Programmatic Queries

Beta

Related Services

CloudWatch Logs
S3 Lifecycle
Glacier

CLI Commands

Check log group retention
aws logs describe-log-groups --query 'logGroups[*].{Name:logGroupName,RetentionDays:retentionInDays}'
Check S3 lifecycle rules
aws s3api get-bucket-lifecycle-configuration --bucket BUCKET_NAME
List Glacier vaults for archives
aws glacier list-vaults --account-id -
Check CloudTrail retention
aws cloudtrail describe-trails --query 'trailList[*].{Name:Name,S3Bucket:S3BucketName}'
Open AWS ConsoleDocumentation

>Related Controls

AU-2
AU-4
AU-5
AU-6
AU-9
AU-14
MP-6
RA-5
SI-12

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of AU-11 (Audit Record Retention)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring AU-11?
  • •How frequently is the AU-11 policy reviewed and updated, and what triggers policy changes?
  • •What training or awareness programs ensure personnel understand their responsibilities related to AU-11?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce AU-11 requirements.
  • •What automated tools, systems, or technologies are deployed to implement AU-11?
  • •How is AU-11 integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce AU-11 requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of AU-11?
  • •What audit logs, records, reports, or monitoring data validate AU-11 compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of AU-11 effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate AU-11 compliance?

Ask AI

Configure your API key to use AI features.