SIEM Log Retention Requirements by Compliance Framework
How long you need to retain logs for HIPAA, PCI-DSS, SOC 2, NIST, and CMMC — and how to implement cost-effective log retention policies.
One of the most common compliance questions MSPs face is: "How long do we need to keep logs?" The answer depends on which compliance framework applies to your client. Here's the definitive guide.
HIPAA
HIPAA requires retention of audit logs for a minimum of 6 years. This includes all access logs for systems containing ePHI, authentication events, configuration changes, and security incident logs. The 6-year requirement comes from the HIPAA administrative simplification provisions (45 CFR §164.530(j)), which require covered entities to retain documentation of policies and procedures for 6 years from the date of creation or the date last in effect.
PCI-DSS
PCI-DSS v4.0 requires audit trail retention for a minimum of 12 months, with at least 3 months immediately available for analysis. This covers all access to cardholder data environments, authentication events, changes to audit logs, and all system-level events. The 3-month "immediately available" requirement means these logs must be in hot storage — not archived to cold storage that takes hours to retrieve.
SOC 2
SOC 2 doesn't specify exact retention periods, but the Trust Services Criteria require that logs be retained long enough to support monitoring and investigation activities. In practice, most auditors expect a minimum of 1 year retention. The key is that you define and document your retention policy and consistently follow it.
NIST SP 800-171 / CMMC
NIST SP 800-171 (required for CMMC Level 2) requires audit log retention for at least 3 months (90 days) with some controls implying longer retention. CMMC assessors typically expect 1 year as a best practice. The requirement is that you retain logs long enough to detect and investigate security incidents.
Cost-Effective Retention Strategies
Retaining 6 years of logs in hot storage is expensive. Use tiered storage: hot storage (immediately searchable) for the most recent 90 days, warm storage (queryable within minutes) for 90 days to 1 year, and cold storage (archival, hours to retrieve) for 1-6 years. Your SIEM should support automatic log tiering based on age, with the ability to promote cold logs back to hot when needed for investigations.