{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/log-retention","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/log-retention/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/log-retention/"},"term":{"en":"Log retention","da":"Logopbevaring"},"aka":{"en":[],"da":[]},"domain":["security"],"cluster":"security-operations","layer":"governance","status":"current","summary":{"en":"Deciding how long each kind of log is kept before it is deleted - long enough to look into incidents, but no longer than needed.","da":"At fastsætte, hvor længe hver slags log gemmes, før den slettes - længe nok til at efterforske hændelser, men ikke længere end nødvendigt."},"body":{"formal":{"en":"A documented rule for each type of log stating how long it is stored, where, how it is protected and when it is deleted, based on the risk assessment, legal duties and the purpose of the log.","da":"En dokumenteret regel for hver type log, der angiver, hvor længe den gemmes, hvor, hvordan den beskyttes, og hvornår den slettes, ud fra risikovurderingen, lovkrav og formålet med loggen."},"plain":{"en":"Like keeping till receipts; throw them out after a day and you cannot handle a return, keep them forever and the back room fills with paper about people who shopped years ago.","da":"Som at gemme kassebonner; smider man dem ud efter en dag, kan man ikke tage imod en returvare, gemmer man dem for evigt, fyldes baglokalet med papir om folk, der handlede for mange år siden."},"inPractice":{"en":"An attack on a pension fund is found in March but began five months earlier; because login logs are kept for twelve months, the fund can trace the first break-in, while web logs holding member data are deleted after ninety days.","da":"Et angreb på en pensionskasse opdages i marts, men begyndte fem måneder tidligere; fordi login-logs gemmes i tolv måneder, kan pensionskassen spore det første indbrud, mens weblogs med medlemsdata slettes efter 90 dage."},"whyItMatters":{"en":"Attackers often go unseen for months, so logs deleted too soon leave no trail; NIS2 and DORA rules expect a documented period, while GDPR forbids keeping personal data longer than needed.","da":"Angribere går ofte uopdaget i månedsvis, så logs, der slettes for tidligt, efterlader intet spor; NIS2- og DORA-reglerne forventer en dokumenteret periode, mens GDPR forbyder at gemme persondata længere end nødvendigt."}},"deepDive":{"en":"A retention decision has two opposing legal and operational pressures. On one side, investigations need history: intrusions are often discovered weeks or months after initial access, and indicators shared by others must be searched retroactively. On the other side, GDPR Art. 5(1)(e) (storage limitation) and Art. 5(1)(c) (data minimisation) forbid keeping personal data, which most security logs contain (usernames, IP addresses, email addresses, device identifiers), longer than necessary for the purpose. Art. 32 simultaneously makes logging part of appropriate security, so the result must be a documented, purpose-based period per log type rather than \"keep everything\" or \"delete quickly\".\n\nFrameworks give reference points rather than a single number. CIS Controls v8 safeguard 8.10 requires retaining audit logs for a minimum of 90 days. PCI DSS v4.0 requirement 10.5.1 requires at least 12 months of audit log history, with at least the most recent three months immediately available for analysis. NIS2 does not fix a period in the directive itself; Commission Implementing Regulation (EU) 2024/2690, which applies to certain digital service providers, sets detailed monitoring and logging requirements in its point 3.2, including protection of logs and a defined retention period, and the DORA RTS on ICT risk management (Delegated Regulation 2024/1774, Art. 12) requires financial entities to define logging procedures including retention. In Denmark, the pre-GDPR security order for public authorities (bekendtgørelse nr. 528 af 15. juni 2000, § 19) required logs of personal-data use to be kept for six months and then deleted; that order has been repealed, and Datatilsynet's current guidance leaves the period to a concrete, purpose-based assessment.\n\nA retention policy should specify for each log source the purpose, the period in hot (searchable) and cold (archive) storage, the storage location and jurisdiction, protection (access control, encryption, immutability), the deletion mechanism, and who can extend retention. Legal holds must be able to suspend deletion for specific data when litigation or a regulatory investigation is anticipated. Pseudonymisation, field-level reduction or aggregation can extend useful retention of security data while reducing personal-data exposure, for example by keeping full authentication logs for a year but reducing web access logs to aggregates after 90 days.\n\nFrequent errors include retention set implicitly by SIEM licence cost rather than by policy, deletion that never happens in backups and archives, and retention periods that differ silently between the source system, the SIEM and the archive. Log retention is distinct from records retention under accounting law (in Denmark, bogføringsloven), and from the telecom data-retention rules, which concern traffic data kept by providers for law enforcement rather than an organisation's own security logs.","da":"En beslutning om opbevaring står i spændet mellem to modsatrettede juridiske og driftsmæssige hensyn. På den ene side kræver efterforskning historik: indbrud opdages ofte uger eller måneder efter den første adgang, og indikatorer, som andre deler, skal kunne søges bagudrettet. På den anden side forbyder databeskyttelsesforordningens art. 5, stk. 1, litra e (opbevaringsbegrænsning), og art. 5, stk. 1, litra c (dataminimering), at personoplysninger, som de fleste sikkerhedslogs indeholder (brugernavne, IP-adresser, e-mailadresser, enheds-id'er), opbevares længere end nødvendigt til formålet. Samtidig gør art. 32 logning til en del af en passende sikkerhed, så resultatet skal være en dokumenteret, formålsbestemt periode pr. logtype frem for \"gem alt\" eller \"slet hurtigt\".\n\nRammeværkerne giver pejlemærker frem for ét tal. CIS Controls v8, safeguard 8.10, kræver, at auditlogs opbevares i mindst 90 dage. PCI DSS v4.0, krav 10.5.1, kræver mindst 12 måneders historik i auditlogs, hvoraf mindst de seneste tre måneder skal være umiddelbart tilgængelige til analyse. NIS2 fastsætter ikke selv en periode i direktivet; Kommissionens gennemførelsesforordning (EU) 2024/2690, der gælder for visse udbydere af digitale tjenester, fastsætter i punkt 3.2 detaljerede krav til overvågning og logning, herunder beskyttelse af logs og en fastlagt opbevaringsperiode, og DORA's RTS om IKT-risikostyring (delegeret forordning 2024/1774, art. 12) kræver, at finansielle enheder fastlægger logningsprocedurer, herunder opbevaring. I Danmark krævede den tidligere sikkerhedsbekendtgørelse for offentlige myndigheder (bekendtgørelse nr. 528 af 15. juni 2000, § 19), at logs over anvendelse af personoplysninger blev opbevaret i seks måneder og derefter slettet; bekendtgørelsen er ophævet, og Datatilsynets nuværende vejledning overlader perioden til en konkret, formålsbestemt vurdering.\n\nEn opbevaringspolitik bør for hver logkilde angive formålet, perioden i hot (søgbar) og cold (arkiv) lagring, lagringssted og jurisdiktion, beskyttelse (adgangskontrol, kryptering, uforanderlighed), sletningsmekanismen og hvem der kan forlænge opbevaringen. Et legal hold skal kunne sætte sletning af bestemte data i bero, når en retssag eller en myndighedsundersøgelse kan forudses. Pseudonymisering, reduktion på feltniveau eller aggregering kan forlænge den nyttige opbevaring af sikkerhedsdata og samtidig mindske eksponeringen af personoplysninger, fx ved at gemme fulde autentificeringslogs i et år, men reducere webadgangslogs til aggregater efter 90 dage.\n\nHyppige fejl er en opbevaringsperiode, der i praksis bestemmes af SIEM-licensens pris frem for af politikken, sletning, der aldrig sker i backup og arkiver, og perioder, der i stilhed er forskellige i kildesystemet, SIEM'en og arkivet. Logopbevaring er noget andet end opbevaring af regnskabsmateriale efter bogføringsloven og end reglerne om teleudbyderes logning, der handler om trafikdata, som udbydere gemmer til brug for politiet, og ikke om en organisations egne sikkerhedslogs."},"edges":[{"type":"requires","to":"cs/audit","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/log-management","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/personal-data","why":{"en":"Logs often hold names, addresses and user names, so the GDPR rule against keeping data longer than needed sets an upper limit.","da":"Logs indeholder ofte navne, adresser og brugernavne, så GDPR's regel om ikke at gemme data længere end nødvendigt sætter en øvre grænse."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/security-incident","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"NIST SP 800-92 - Guide to Computer Security Log Management","url":"https://doi.org/10.6028/NIST.SP.800-92","tier":"standard","publisher":"NIST"},{"title":"Commission Delegated Regulation (EU) 2024/1774 (DORA RTS on ICT risk management) - Article 12, Logging","tier":"standard","publisher":"European Union"},{"title":"Commission Implementing Regulation (EU) 2024/2690 (NIS2) - Annex, point 3.2 Monitoring and logging","tier":"standard","publisher":"European Union"},{"title":"GDPR (Regulation (EU) 2016/679) - Article 5(1)(e), storage limitation","tier":"standard","publisher":"European Union"},{"title":"Bekendtgørelse nr. 528 af 15. juni 2000 om sikkerhedsforanstaltninger til beskyttelse af personoplysninger, som behandles for den offentlige forvaltning (repealed)","url":"https://www.retsinformation.dk/eli/lta/2000/528","tier":"standard","publisher":"Justitsministeriet"},{"title":"Datatilsynet - Logning af brugernes anvendelser af personoplysninger","url":"https://www.datatilsynet.dk/regler-og-vejledning/behandlingssikkerhed/katalog-over-foranstaltninger/logning-af-brugernes-anvendelser-af-personoplysninger","tier":"official-doc","publisher":"Datatilsynet"}],"draft":true}