---

id: "AU-11(01)" title: "Long-term Retrieval Capability" family: "AU" family_name: "Audit and Accountability" sort_id: "au-11.01" priority: "P2" implementation_level: "organization" parent: "AU-11" enhancement: True

---

Statement

Employ {{ insert: param, au-11.01_odp }} to ensure that long-term audit records generated by the system can be retrieved.

Guidance

Organizations need to access and read audit records requiring long-term storage (on the order of years). Measures employed to help facilitate the retrieval of audit records include converting records to newer formats, retaining equipment capable of reading the records, and retaining the necessary documentation to help personnel understand how to interpret the records.

Assessment Objective

{{ insert: param, au-11.01_odp }} are employed to ensure that long-term audit records generated by the system can be retrieved.

Audit and accountability policy

system security plan

privacy plan

audit record retention policy and procedures

system design documentation

system configuration settings and associated documentation

audit record archives

audit logs

audit records

other relevant documents or records

Organizational personnel with audit record retention responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Mechanisms implementing audit record retention capability