ED Decision 2023/009/R
The objective of the requirement under (a)(1)(vi) is to ensure detection of possible indication of information security incidents or vulnerabilities which are not obvious by normal operation (e.g. previously unknown situations), while the objective of the requirement under (a)(5) is to allow the necessary flexibility to control the volume of the stored information security events.
Records of information security events include those events identified to be within the scope of the detection activities under IS.I.OR.220(a), as well as other information security data produced by assets that have been identified under IS.I.OR.205.
A data retention policy clarifies what information should be stored or archived and for how long. Some guidance about data retention can be found in EUROCAE ED-206, Chapter 2.6.
Once a data set completes its retention period, it can be deleted or moved as permanent historical data to a secondary or tertiary storage.
Loading collections...