Log Retention Requirements Map by Regulation and Sector

Most organisations cannot say which rule sets their log retention period, so they either keep everything forever or rely on a platform default that quietly deletes evidence after 30 or 90 days. This map lists the published minimum retention periods for security logs and audit trails across the main regimes: US federal guidance, PCI DSS, HIPAA, SEC and FINRA, NYDFS, the EU NIS2 implementing rules and DORA, MiFID II, India's CERT-In directions, the UK NCSC and the Australian ISM. For each it shows the period, whether logs must be immediately searchable or merely retrievable, any format rule, and where no fixed period exists. It then explains how to resolve conflicts with data protection law and how to build one retention schedule. It is for security engineers, GRC teams, records managers and legal counsel. Status as of 11 November 2026.

Source note: this map summarises official texts, regulator guidance and the sources listed at the end, with status as of 11 November 2026. It is not legal advice. Confirm against the official text before relying on it.

Key takeaways

Fixed periods are the exception. PCI DSS, CERT-In, OMB M-26-14 and the Australian ISM set numbers; DORA and the NIS2 implementing regulation require you to define and justify your own period.
Searchable and retrievable are different obligations. M-26-14 asks for 6 months searchable and 1 year retrievable, PCI DSS for 3 months immediately available within 12 months; write both columns into your schedule.
Records rules can outlast security rules. SEC Rule 17a-4, FINRA 4511, MiFID II and NYDFS 500.6 set retention of three to seven years for records and audit trails that often include system logs.
Location can matter as much as duration. CERT-In requires a rolling 180 days of ICT system logs kept within Indian jurisdiction, which affects where a global SIEM stores data.
Machine identity logs are in scope everywhere. The NIS2 implementing rules name user creation, permission changes, authentication and privileged activity, which covers service accounts, API keys and AI agents as much as people.

Regulations and frameworks at a glance

Regime	Who it applies to	What must be kept	Minimum period	Access or format rule	Status (11 November 2026)
US OMB M-26-14	US federal agencies and systems operated on their behalf	Logs listed in the CISA Logging Requirements Addendum	Searchable 6 months, retrievable 1 year after creation	Does not override records schedules	Issued 22 May 2026; rescinded M-21-31
PCI DSS v4.0.1, Requirement 10.5.1	Entities that store, process or transmit cardholder data	Audit log history for the cardholder data environment	12 months	Most recent 3 months immediately available for analysis	In force
HIPAA Security Rule, 45 CFR 164.316(b)(2)	US covered entities and business associates	Required documentation of actions, activities and assessments	6 years from creation or last effective date	164.312(b) requires audit controls but sets no log period	In force
SEC Rule 17a-4	US broker-dealers	Books and records listed in 17a-3	6 years (paragraph (a)) or 3 years (paragraph (b))	First 2 years easily accessible; non-rewriteable non-erasable storage or a complete time-stamped audit trail	In force
FINRA Rule 4511	FINRA member firms	Books and records with no other specified period	At least 6 years	Format must comply with SEA Rule 17a-4	In force
NYDFS 23 NYCRR 500.6	NYDFS-regulated covered entities	Systems to reconstruct material financial transactions and audit trails to detect and respond to cybersecurity events	Not fewer than 5 years	Scope based on the risk assessment	In force
EU NIS2 Implementing Regulation (EU) 2024/2690, Annex 3.2	DNS, TLD, cloud, data centre, CDN, MSP, MSSP, marketplaces, search engines, social networks, trust services	Network traffic, account and permission changes, authentication, privileged activity, security tool logs and more	A "predefined period" set by the entity	Back up logs, protect from unauthorised access or changes, synchronise time	Applies
EU DORA RTS (EU) 2024/1774, Article 12	EU financial entities	Access control and identity, capacity, change, ICT operations and network traffic events	Set by the entity, justified against objectives and risk assessment	Tamper protection, logging failure detection, reference time source	Applies since 17 January 2025
EU MiFID II, Article 16(7)	Investment firms	Records of telephone conversations and electronic communications relating to transactions	5 years, up to 7 where the competent authority requests	Available to supervisors	In force
India CERT-In Directions, 28 April 2022	Service providers, intermediaries, data centres, body corporates and government organisations	Logs of all ICT systems	Rolling 180 days	Kept within Indian jurisdiction; provided to CERT-In on request or with incident reports	In force
Australian ISM, ISM-1988 and ISM-1989	Australian government and organisations applying the ISM	Event logs	Searchable at least 12 months; also the minimum periods in AFDA Express Version 2	Searchable manner	Current ISM
UK NCSC logging guidance	Guidance for any UK organisation	Logs that answer the incident questions	Minimum 6 months recommended	Longer if budget allows	Guidance, not law
CIS Controls v8.1, Safeguard 8.10	Organisations using CIS Controls	Audit logs across the enterprise	Minimum 90 days	None stated	Framework
GDPR Article 5(1)(e)	Logs containing personal data of people in the EU and UK	Any identifiable data in logs	No minimum; a maximum of "no longer than necessary"	Document the purpose and justification	In force

This map covers security logs and audit trails. For how to collect, store and protect logs, see the Log Management and Retention Guide. For business records in general, see the Data Retention Schedule Template.

Scope: who and what is covered

Three kinds of rule set retention for logs, and most organisations are subject to at least two.

Security logging rules: M-26-14, PCI DSS Requirement 10, the NIS2 implementing regulation, DORA Article 12, CERT-In and the ISM aim at detecting and investigating intrusions. They name log sources and expect tamper protection.
Records rules: SEC 17a-4, FINRA 4511, MiFID II and HIPAA documentation rules aim at reconstructing business activity for supervisors. They apply to system logs where those logs are, or support, a required record, for example order audit trails, communications archives or the record of an access review.
Data protection rules: GDPR and similar laws set no minimum, but they cap retention of identifiable data. IP addresses, user names and device identifiers in logs are personal data, so the security period must be justified, not assumed.

Sector rules sit on top of these. A card-accepting investment firm in Frankfurt with Indian operations can be subject to PCI DSS, DORA, MiFID II, GDPR and CERT-In at the same time, each with a different number and a different reason.

Key obligations

Periods you must define yourself

DORA RTS Article 12 requires logging procedures that identify "the retention period of the logs" and states that the financial entity shall establish that period taking into account its business and information security objectives, the reason the event is recorded and the results of its ICT risk assessment. The NIS2 implementing regulation, Annex point 3.2.5, requires entities to maintain and back up logs "for a predefined period". Neither text gives a number, so supervisors will ask for the reasoning. A defensible answer ties each category's period to detection lag (how long intrusions take to surface), to investigation needs and to any longer sector rule.

Searchable versus retrievable

Source	Hot (searchable now)	Cold (retrievable with preparation)
OMB M-26-14 Appendix B	6 months, for continuous event monitoring	1 year after creation, for threat hunting, investigation, response and forensics
M-26-14 maturity Level 3	3 months	12 months
PCI DSS 10.5.1	3 months immediately available	12 months in total
Australian ISM-1988	12 months searchable	Longer periods under AFDA Express (ISM-1989)
SEC 17a-4	First 2 years easily accessible	Remainder of the 3 or 6 years

Format and integrity rules

SEC 17a-4(f)(2): either keep records in a non-rewriteable, non-erasable format or keep a complete time-stamped audit trail of every modification and deletion that allows the original to be recreated; verify storage automatically; allow download in human-readable and usable electronic formats; keep a backup or other redundancy.
NIS2 Annex 3.2.5 and 3.2.6: protect logs from unauthorised access or changes, synchronise time sources, make logging systems redundant and monitor logging availability independently of the systems being monitored.
DORA Article 12: safeguards against alteration, deletion and unauthorised access at rest, in transit and in use, plus detection of logging system failure.
CERT-In: logs stored within Indian jurisdiction and handed to CERT-In with an incident report or on direction.

Maximum limits

GDPR Article 5(1)(e) storage limitation applies to logs that identify people. It does not prevent keeping security logs for a year or more, but it requires a documented purpose, access restrictions and deletion or pseudonymisation when the period ends. Where a mandatory minimum applies, that legal obligation is the justification; where you chose the period yourself (DORA, NIS2), record the risk reasoning.

Timeline and current status

28 April 2022: CERT-In issues its directions under section 70B(6) of the IT Act, including 180-day log retention in India.
17 January 2025: DORA applies, with the ICT risk management RTS (EU) 2024/1774 in force since July 2024.
October 2024 onwards: NIS2 Implementing Regulation (EU) 2024/2690 sets the technical measures for digital infrastructure and digital provider entities.
22 May 2026: OMB M-26-14 rescinds M-21-31. CISA was to publish a Logging Requirements Addendum within 90 days; agencies then have 90 days for a first logging plan, 120 days to reach Level 1, 180 days for Level 2 and 320 days for Level 3.
Older contracts: M-21-31 periods (12 months active plus 18 months cold for most categories) still appear in federal contracts and supplier questionnaires. Check which memo a contract cites before changing retention.

Enforcement and penalties

Retention failures are rarely enforced alone. They surface when an investigation cannot answer basic questions, or when a regulator asks for records that no longer exist. PCI DSS assessors test Requirement 10.5.1 directly and a failed requirement affects the Report on Compliance. Under DORA and NIS2, missing or unjustified retention is a gap in the ICT risk management framework and falls under the general penalty regimes of those laws. Records rules are enforced most often: SEC and FINRA have repeatedly fined firms for failing to preserve electronic communications. The practical penalty is investigative: the Microsoft Storm-0558 intrusion was found through mailbox access logs that only some customers retained at the time, see the Microsoft Storm-0558 Key Breach.

What it means for AI agents and non-human identities

Every regime above is written about systems and events, not people, so machine activity is fully in scope. The NIS2 implementing regulation lists creation, modification or deletion of users and extensions of permissions, authentication events and privileged account activity; DORA names access control and identity management. In practice:

Service accounts and workload identities: keep cloud control plane logs (role assumption, key creation, token issuance) for the longest period that applies, because stolen machine credentials are often found months after first use. See the Cloud Logging and Audit Trail Guide.
SaaS audit logs: many SaaS plans keep audit logs for 90 or 180 days by default. Export them to your own store to meet a 12-month rule. See the SaaS Audit Log Retention and Licensing Guide.
AI agents: tool calls, prompts and delegated actions are the agent's audit trail. Where an agent acts in a regulated process (trading, payments, health records), its logs may be records under the sector rule, not just security logs. See the AI Agent Audit Log Schema Template.
Secrets in logs: a long retention period multiplies the risk of tokens logged in clear text. Mask secrets at source before applying a multi-year period.

Compliance steps

Inventory obligations: list every regime that applies by entity, country and data type, using the table above as the starting point, and confirm sector rules with counsel.
Classify log sources: group logs into categories (identity, cloud control plane, endpoint, network, application, database, communications) and record which obligation drives each.
Set two periods per category: searchable and retrievable, taking the longest applicable minimum and recording the legal basis or risk reasoning.
Check location: mark categories that must stay in a country (India under CERT-In) and confirm the SIEM and archive regions.
Apply integrity controls: object lock or immutable storage for categories under SEC 17a-4 or where tampering is a realistic threat, plus separate administrative control of the archive.
Test retrieval: restore a sample from the oldest cold tier each quarter and time it against the period you promise supervisors.
Apply the maximum: automate deletion or pseudonymisation at the end of each period unless a legal hold applies, and log the deletion.
Review annually: re-check periods when a regulation, a contract or the CISA addendum changes.

Measuring it

Coverage: percentage of in-scope log sources with a documented searchable and retrievable period.
Gap days: sources whose actual platform retention is shorter than the schedule, and by how many days.
Retrieval time: median hours to restore and query a sample from the oldest tier.
Integrity: percentage of regulated categories on immutable storage with verified hashes.
Deletion compliance: percentage of expired log data deleted or pseudonymised on schedule.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	AU-11 Audit Record Retention; AU-4 Audit Log Storage Capacity; AU-9 Protection of Audit Information	Retention period, capacity and tamper protection
NIST SP 800-171 Rev. 3	03.03.01 Event Logging; 03.03.08 Protection of Audit Information	CUI systems in the supply chain
NIST CSF 2.0	PR.PS-04 Log records are generated and made available for continuous monitoring	Outcome the retention schedule supports
CIS Controls v8.1	Control 8, Safeguard 8.10 Retain Audit Logs	90-day baseline; see the CIS Control 8 Audit Log Management Guide
MITRE ATT&CK v20	T1685.005 Clear Windows Event Logs; T1685 Disable or Modify Tools	Why logs must be copied off host and protected

Common failure patterns

Platform defaults treated as policy: a 30-day cloud or SaaS default silently becomes the retention period.
One period for everything: keeping all logs for seven years inflates cost and GDPR exposure; keeping all for 90 days fails PCI DSS and DORA reasoning.
Cold archives nobody can read: archives in a format or schema that cannot be queried after a migration do not meet "retrievable".
Logs stored only where the attacker is: local event logs cleared during an intrusion, with no central copy.
Citing a rescinded rule: policies still quoting M-21-31 without noting M-26-14.

Practitioner checklist

List every regime that sets a log or record retention period for each legal entity.
Record a searchable and a retrievable period for each log category, with its source.
Document the risk reasoning for periods you set yourself under DORA and NIS2.
Confirm in-country storage for logs subject to CERT-In.
Use immutable storage or a full audit trail for records under SEC 17a-4.
Compare actual platform and SaaS retention with the schedule every quarter.
Keep identity, privilege and machine credential events for the longest applicable period.
Mask secrets and minimise personal data before long retention.
Test restore from the oldest tier and record the time taken.

Standards and references

This guide summarises log retention requirements as of 11 November 2026 and is not legal advice. Related NHI Mgmt Group resources: Log Management and Retention Guide · SaaS Audit Log Retention and Licensing Guide · Cyber Incident Reporting Requirements Map · Financial Services Cyber Regulation Map

Log Retention Requirements Map: Minimum Periods by Regulation and Sector