How long should IT keep system access logs and audit logs?

There is no single universal answer. How long IT should keep system access logs and audit logs depends on the purpose the logs serve, the value of the systems and data they protect, and the legal, regulatory, and contractual obligations that apply to your organization. The right approach is to set a defined retention period in an approved schedule rather than keeping logs “forever” or deleting them on an ad hoc basis.

What drives the retention period

Several factors shape how long these logs should be kept:

• Operational and security need. Logs support troubleshooting, intrusion detection, and incident investigation. Many security programs keep readily searchable logs online for a shorter window (often months) and retain them in archived form for longer.
• Legal and regulatory requirements. Some sectors—financial, healthcare, government, and others—impose specific minimum retention periods. Where a rule applies, it sets the floor.
• Litigation and investigation holds. If logs are relevant to anticipated or active litigation, an audit, or a public-records request, a legal hold can override the normal schedule and require you to preserve them.
• Privacy obligations. Logs may contain personal data. Privacy principles favor keeping such data only as long as needed for a defined purpose, which argues against indefinite retention.

How to set a defensible period

Treat access and audit logs as records and apply a retention schedule:

1. Identify the systems and the role each log plays (security monitoring, compliance evidence, forensic reconstruction).
2. Map applicable laws, regulations, standards, and contractual terms to find any mandatory minimums.
3. Choose a defined retention period that satisfies those obligations and your operational needs, then dispose of logs consistently once it lapses.
4. Document the schedule, secure approval, and apply it through automated, auditable processes.

U.S. federal agencies should consult the National Archives General Records Schedules, which cover common information-technology records, including system access and audit logs, and provide governmentwide disposition authority. Organizations of any kind can apply the records-management framework in ISO 15489-1 to build a sound schedule.

Consistent, documented retention—neither over-retention nor premature deletion—is what makes your logging program defensible. For broader guidance on building schedules, see the retention and disposition topic hub.