AU-11 Audit Record Retention

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High, Privacy	Organization	1 (0 in a baseline)

Related controls: AU-2, AU-4, AU-5, AU-6, AU-9, AU-14, MP-6, RA-5, SI-12

Control statement

Retain audit records for [Assignment: organization-defined time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

NIST discussion

Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.

Control enhancements

AU-11(1) Long-term Retrieval Capability

Baselines: Not in a baseline

Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved.

Discussion and assessment objectives for AU-11(1)

Organizations need to access and read audit records requiring long-term storage (on the order of years). Measures employed to help facilitate the retrieval of audit records include converting records to newer formats, retaining equipment capable of reading the records, and retaining the necessary documentation to help personnel understand how to interpret the records.

Determine if [Assignment: organization-defined measures] are employed to ensure that long-term audit records generated by the system can be retrieved.

Examine: Audit and accountability policy; system security plan; privacy plan; audit record retention policy and procedures; system design documentation; system configuration settings and associated documentation; audit record archives; audit logs; audit records; other relevant documents or records.

Interview: Organizational personnel with audit record retention responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.

Test: Mechanisms implementing audit record retention capability.

Assessment objectives (SP 800-53A)

Objectives and methods for AU-11

Determine if audit records are retained for [Assignment: organization-defined time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Examine: Audit and accountability policy; system security plan; privacy plan; audit record retention policy and procedures; security plan; organization-defined retention period for audit records; audit record archives; audit logs; audit records; other relevant documents or records.

Interview: Organizational personnel with audit record retention responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.

Policy statement

• The System owner shall retain audit records for Fill in: a time period to retain audit records that is consistent with the records retention policy Typical: at least one year, or longer where the records retention schedule or a law requires it to support after-the-fact investigation of incidents and to meet regulatory and organizational retention requirements. (AU-11)

Federal systems

OMB M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded OMB M-21-31. Its Appendix B requires retained logs to be actively searchable for at least 6 months after creation and retrievable for a year after creation, and notes that meeting these minimums does not relieve agencies of other requirements, such as those set by agency-specific or government-wide records schedules. It does not apply to national security systems. As of September 2026.

• The System owner shall keep audit records actively searchable for at least 6 months after creation, and retrievable for at least one year after creation, as OMB M-26-14 requires. (AU-11)

From the Audit and Accountability Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AU-11 asks you to keep audit records long enough to investigate incidents after the fact and to meet legal and organizational retention requirements. NIST’s AU-11 discussion says to keep them until they are no longer needed for administrative, legal, audit or other purposes, including Freedom of Information Act (FOIA) requests, subpoenas and law enforcement actions. Set one retention period, then apply it on the log platform and on any system that keeps its own logs.

Common implementations. Retention set on the central log platform, with recent records in a searchable tier and the rest in an archive tier that can be restored for search. A legal hold process that stops deletion of the records named in a hold. Records disposed of at the end of the period, following the records retention schedule. Archive restores tested, so the records can actually be read when needed. The system monitoring standard sets the same retention for monitoring data, with a searchable period to fill in.

Organization-defined parameters. Typical value, which your organization may set differently:

Parameter	Typical value
Retention period (AU-11)	At least one year, or longer where the records retention schedule or a law requires it

In the Audit and Accountability policy, the system owner retains audit records for this period. AU-4 sizes the storage to match. Section 10 of the audit logging standard adds the searchable period, legal holds, archive integrity checks, disposal and restore tests.

Evidence assessors ask for.

• The retention requirement and its source, such as the records retention schedule
• Retention settings on the log platform and on any system that keeps its own logs
• A demonstration of retrieving a record near the end of the retention period
• The legal hold procedure, and records of any holds applied

Inheritance. Retention on a central log platform is usually a common control. The system owns retention of logs it keeps only locally, such as application audit trails in its own database, so AU-11 is often a hybrid control.

Common findings.

• Retention on the platform shorter than the policy states, often set down to save storage.
• Archives that exist but have never been restored, and cannot be read when needed.
• Application audit trails purged by a routine cleanup job, outside the retention period.
• Records deleted during a legal hold because the hold never reached the log platform’s owners.

Enhancements in the Moderate baseline. None. AU-11(1) long-term retrieval capability is in no baseline. AU-11 itself is also in the Privacy baseline, so it applies to any system that processes personally identifiable information.

Federal systems (as of September 2026). OMB M-26-14 (May 22, 2026), which rescinded M-21-31, requires retained logs to be actively searchable for at least 6 months after creation and retrievable for a year after creation (Appendix B item 1). It notes that these minimums do not relieve agencies of other requirements, such as agency-specific or government-wide records schedules. NIST’s AU-11 discussion points to the National Archives and Records Administration’s General Records Schedules for federal retention policy. The policy’s federal block and the system monitoring standard both carry the M-26-14 minimums; M-26-14 does not apply to national security systems.

Artifacts

• Audit and Accountability Decision Worksheet
• Audit and Accountability Policy
• Audit Logging Standard
• System Monitoring Standard