Security Audit Log Retention Policy

We retain security audit logs for a minimum of 365 days online and 3 years in cold storage. Authentication logs, privileged access logs, and CUI access logs follow this schedule. Firewall and endpoint detection logs are retained 180 days online and 1 year archive unless under legal hold.

Audit logs are write-once, hash-chained for tamper evidence, and access-restricted to security operations and compliance. Clock synchronization uses authenticated NTP. Log deletion before retention expiry requires dual approval from CISO and Legal.