Audit Record Retention AU-11

Audit and Accountability · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AU-11 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-11 (Audit Record Retention) sets how long audit records are kept so you can support after-the-fact investigations of incidents and meet any regulatory and organizational retention rules. NIST leaves the exact length as an organization-defined value — you decide the period and then hold the records for it. It is a foundational Audit and Accountability control in the Low baseline.

What good looks like

Decide and write down a retention period (for example, 90 days on the host and one year archived), based on how long an investigation might reach back and on any rule you must meet.
Keep enough history that you can investigate an incident discovered weeks later — not just the last few days of logs.
Rotate on a schedule so records age out on purpose, rather than being deleted early or left to fill the disk.
Archive older records off the host so a wiped or reinstalled machine does not take its own history with it.
Be able to show on demand that records covering the full required period actually exist.

Framework mapping

NIST CSF 2.0 — PR.PS-04 — Log records are generated and made available for continuous monitoring
CIS Controls v8 — Control 8 — Audit Log Management

How to move it toward Implemented

Set a retention window on the audit daemon: in /etc/audit/auditd.conf raise num_logs and max_log_file, and set max_log_file_action = ROTATE, so auditd keeps enough back-history instead of overwriting.
Hold journal history for the chosen window: set MaxRetentionSec= (for example, MaxRetentionSec=90day) and a sane SystemMaxUse= in /etc/systemd/journald.conf, then systemctl restart systemd-journald.
Set /etc/logrotate.d rules for /var/log/auth.log and friends to rotate for the full period and compress old files, and copy the compressed archives off-host (an rsyslog forward or a nightly rsync) so the trail survives a host wipe.
Attach the auditd, journald, and logrotate config plus a dated listing that proves records reach back the full period (for example, journalctl --list-boots and ls -l /var/log) as hardening evidence on the asset, naming AU-11 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.