On this page
The short answer
Most frameworks do not give a number. SOC 2, ISO 27001, GDPR, NIST SP 800-53 and HIPAA's audit controls all leave the retention period for logs to you. The frameworks that do set one range from 90 days to seven years, and they apply to specific industries or kinds of data.
If you need a starting point and none of the specific rules below applies to you, twelve months of audit logs, with the most recent three months quick to search, is the figure PCI DSS uses and the one enterprise customers most often expect. Treat that as a common default, not as a rule.
Every row below was checked against the regulation or standard itself on 12 November 2026, except where the note says otherwise. This is a summary, not legal advice, so confirm the rules that apply to you with your auditor or counsel.
Frameworks that state a number
These set a period in their own text. Check the scope before you adopt a number: most apply only to certain organizations, systems or records.
| Framework | Clause | What it says | Period |
|---|---|---|---|
| PCI DSS v4 | Requirement 10.5.1 | Keep audit log history, with the most recent three months immediately available for analysis | 12 months |
| NYDFS Cybersecurity Regulation | 23 NYCRR 500.6(b) | Records to reconstruct financial transactions for five years; audit trails for detecting cybersecurity events for three | 5 years and 3 years |
| EU AI Act | Articles 19(1) and 26(6) | Providers and deployers of high-risk AI systems keep the automatically generated logs | At least 6 months |
| US federal agencies | OMB M-26-14, Appendix B | Logs searchable for at least six months and retrievable for a year after creation | 6 months searchable, 12 months retrievable |
| CJIS Security Policy v6.1 | AU-11 | Keep audit records for at least one year, or until no longer needed for administrative, legal or audit purposes | 1 year minimum |
| IRS Publication 1075 | AU-11 | Audit records for systems handling federal tax information | 7 years |
| NERC CIP-007-6 | R4, Part 4.3 | Event logs for high impact systems, and medium impact ones at control centers, where technically feasible | 90 days |
| CIS Controls v8.1 | Safeguard 8.10 | Retain audit logs across enterprise assets | 90 days minimum |
| Australian ISM | ISM-1988 | Event logs kept searchable | 12 months minimum |
| FDA 21 CFR Part 11 | Section 11.10(e) | Audit trail kept at least as long as the electronic record it describes | Same as the record |
Frameworks that leave it to you
These require logging, or evidence that relies on it, and set no retention period for logs. Your own policy becomes the requirement, and an auditor will check you against it.
| Framework | Clause | What it says about retention |
|---|---|---|
| SOC 2 | Trust Services Criteria, CC7.2 and related | No period. The auditor needs evidence for the whole audit period, so in practice you need at least that long |
| ISO/IEC 27001:2022 | Annex A 8.15 | No period. The organization decides and documents it |
| HIPAA Security Rule | 45 CFR 164.312(b) | No period for audit logs. The six-year rule in 164.316(b)(2)(i) covers required documentation |
| GDPR | Article 5(1)(e) | No period. Personal data is kept no longer than necessary, which limits how long you keep logs that contain it |
| NIST SP 800-53 Rev. 5 | AU-11 | A period the organization defines, consistent with its records retention policy |
| FedRAMP | AU-11 | Organization-defined under the 2026 rules. FedRAMP has removed most of its own assigned values |
| NIST SP 800-171 (CMMC Level 2) | 3.3.1 | Keep records to the extent needed for monitoring and investigation. No number |
| DORA | Delegated Regulation (EU) 2024/1774, Article 12 | The financial entity sets the retention period for its logs |
| NIS2 | Implementing Regulation (EU) 2024/2690, Annex 3.2.5 | Logs kept for a predefined period. No number |
| SOX | 18 U.S.C. 1520 and SEC Rule 2-06 | Nothing on system logs. The periods cover the auditor's own workpapers |
Three numbers that get misquoted
HIPAA and six years. You will often read that HIPAA requires audit logs to be kept for six years. The audit controls standard, 164.312(b), sets no period at all. The six years comes from 164.316(b)(2)(i), which covers documentation the rule requires: policies, procedures and records of required actions and assessments. Many organizations choose six years for logs to be safe, and that is a reasonable choice, but it is a choice. A rule proposed in January 2025 would add a retention duty for activity records, still without a number, and it has not been finalized.
SOX and seven years. The seven years is real, and it belongs to auditors. Section 802 of the Act sets five years in statute for audit workpapers, and SEC Rule 2-06 extends that to seven years after the audit concludes. Neither says anything about a company's system logs. If your logs support financial controls, your auditor may still want them for the period under audit.
Federal agencies and thirty months. Guides still cite OMB memorandum M-21-31: twelve months of active storage plus eighteen months of cold storage. That memo was rescinded on 22 May 2026. Its replacement, M-26-14, asks for logs searchable for at least six months and retrievable for a year. FedRAMP's baseline used to point to the old memo, and its 2026 rules now leave the period to the organization.
How to choose your period
Start with the rules that bind you. List the frameworks and contracts that apply, and take the longest period any of them sets for the logs in question. A payment company that also sells to New York financial firms has two different numbers to meet.
Read your customer contracts. For most software companies the binding number is not in a regulation. It is in a customer's security addendum, or in the answer you gave on their questionnaire. Larger customers commonly ask for at least a year.
Cover your own audit. If you are in a SOC 2 Type II audit, you need the logs behind your controls for the whole audit period, plus the time it takes to finish the report.
Then push the other way. Under GDPR and similar laws, keeping personal data longer than you need is itself a problem. Keep personal data in log entries to what the entry needs, and do not default to "forever". A written period you can justify is safer than an open-ended one.
Decide what "kept" means. PCI DSS and the federal memo both separate logs you can search now from logs you can retrieve later. Cheap archive storage is fine for the older part, as long as you have tested getting something back out of it.
Plan for holds. A dispute or investigation can require you to keep specific records past their normal period. Your deletion process needs a way to pause.
Retention is not much use without integrity
A retention period answers how long you keep a log. It says nothing about whether the log you produce in year three is the one that was written in year one. Several of these frameworks ask for both. PCI DSS requires that log files be protected from modification, and ISO 27001's logging control covers protection as well as storage.
So write the two together. When you set a retention period, also decide how you would show that a record has not changed during it, and how a deletion at the end of the period is recorded. A log that simply has fewer rows than it used to raises questions that a logged, scheduled deletion does not.
What to write in your policy
An auditor or a customer wants to see four things: the period, what it covers, the reason, and what happens at the end. A short statement is enough.
How Invoance Audit Logs handles retention
In Invoance Audit Logs, retention is set for each customer organization, so one customer can be on twelve months and another on seven years. The longest period available depends on your plan: 30 days on the free Developer plan, one year on Builder, and seven years on Growth and Compliance. Recent events stay in a faster query window, from 30 days up to a year depending on plan.
Every event is signed and numbered when it is written, so an event read back in year three can be checked against the signature made in year one. Events past the retention period are sealed from the read endpoints. Customers who need their own copy for longer can take CSV or NDJSON exports, or stream events to their own systems as they happen.
Invoance does not decide your period for you, and it is not a records-management system for the rest of your logs. It covers the audit events your application sends.