Ensure Adequate Audit Log Storage

Here’s a pattern that repeats in incident after incident. The investigation finally pinpoints the moment that matters, everyone goes to pull the logs for that date, and they’re gone. Not deleted by an attacker. They simply aged out, because storage was sized to hold a few weeks and the intrusion started months earlier. Control 8.3 is about making sure the evidence is still there when you finally go looking for it.

This is the third piece of the logging story. Control 8.1 decided what to record, 8.2 collected it, and 8.3 makes sure you keep it long enough to matter. Skip this one and the first two quietly stop paying off.

What this control actually says (in plain English)

Here’s the translation: keep enough log history, for long enough, that you can look back as far as an investigation might need.

Now the official version. Control 8.3 says you should ensure that your logging destinations maintain adequate storage to meet the retention requirements defined in your audit log management process.

Notice that it points back to the process from 8.1. The right amount of storage isn’t a fixed number. It’s whatever it takes to honor the retention period you already decided you needed.

Why business leaders should care

The uncomfortable truth about intrusions is that most of them are not discovered the day they happen. Attackers frequently sit in an environment for weeks or months before anything is noticed, quietly looking around before they act. That gap is exactly why retention matters. If your logs only reach back thirty days and the intrusion began ninety days ago, the most important evidence expired long before you knew you needed it. Your retention window sets a hard limit on how far back your organization can ever see.

There’s a compliance dimension too. Many regulations and most cyber-insurance policies now expect a minimum retention period, often measured in months rather than weeks. Sizing storage to keep logs for a meaningful window isn’t just good practice. It’s increasingly the baseline others hold you to.

What “good” looks like

Getting this right is mostly a matter of deciding on a number and making sure your storage can honor it. Here’s the practical path.

• Set retention against real investigations, not convenience. Ask how far back you’d genuinely want to look if you discovered a problem today, then keep logs at least that long. For most small and mid-sized organizations, that means months, not weeks.
• Size storage, or use a service that handles it. Either provision enough storage for your chosen window or use a cloud log service that retains data for a defined period, so old records aren’t silently overwritten to make room.
• Protect the store from tampering and loss. Keep the retained logs somewhere an attacker who compromises a device can’t reach or erase, and make sure the storage itself is backed up or resilient.
• Watch for silent rollover. Confirm that logs are actually being retained for the full window and not quietly aging out early because a volume filled up.

The audit and defensibility angle

Retention is where a logging program either holds up or collapses under real scrutiny. An auditor doesn’t just want to know that you collect logs. They want to know you can still produce them for the period that matters. When a client, a regulator, or an insurer asks you to demonstrate what happened during a window that closed months ago, adequate storage is the difference between a confident answer and an apology. It’s the least visible part of logging and often the one that decides whether the rest of the effort was worth anything.

The logs you most need are almost always the ones from further back than you kept. Deciding on a real retention window and giving it the storage to survive is a quiet, one-time decision that determines how far your organization can see when it finally has to look. Keep the history long enough, protect it well enough, and the record will still be there on the day the question finally gets asked.