What it means
Retention defines what is kept, for how long, at what fidelity, and under which disposal rules. Integrity controls protect records against unauthorized change, deletion, time manipulation, and loss of provenance.
Why it matters
Logs have little evidentiary value when important events are missing, clocks are inconsistent, retention is too short, or administrators can alter the record without detection.
Practical focus
- Define event, retention, access, and disposal requirements
- Protect time synchronization and source identity
- Use separation, restricted access, and tamper-evident storage
- Test retrieval, analysis, and legal-hold processes
Common mistakes
- Keeping every event without a use case
- Assuming cloud defaults satisfy retention needs
- Protecting storage but not collection and transport
- Setting retention only from technical capacity
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: