10.5.1Audit log history is retained and available for analysis

Defined Approach Requirements:

Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis.

Defined Approach Testing Procedures:

10.5.1.a Examine documentation to verify that the following is defined:

- Audit log retention policies.

- Procedures for retaining audit log history for at least 12 months, with at least the most recent three months immediately available online.

10.5.1.b Examine configurations of audit log history, interview personnel and examine audit logs to verify that audit logs history is retained for at least 12 months.

10.5.1.c Interview personnel and observe processes to verify that at least the most recent three months' audit log history is immediately available for analysis.