ISO/IEC 27035 FAQ Retained Logs

Preserve the event report, incident management log, classification and escalation decisions, response actions, communications, notification records, recovery validation, incident report, lessons learned, and linked evidence needed to reconstruct the case. Maintain an incident register for oversight and trend analysis. Raw telemetry, working notes, malware samples, exports, and forensic images can need different storage, access, and retention rules.

ISO/IEC 27035 does not set a universal number of days or years. Define retention by record purpose, investigation and operational need, applicable law and contracts, privacy and employment rules, limitation periods, insurance terms, and litigation or regulatory holds. A hold is an authorized instruction that suspends ordinary disposal for specified material. Document which rule wins when periods conflict.

For records used only to manage the case, preserve authenticity, access control, version history, timestamps, and links to the incident register. For potential digital evidence, use procedures suited to the intended investigation or proceeding, including identification, collection, acquisition, preservation, integrity verification, access logs, and chain of custody.

Do not describe every operational log as forensic evidence. Apply the stronger handling process when legal prosecution, disciplinary action, litigation, regulatory review, or another evidential purpose is reasonably possible.

The incident-management owner should define the operational record set with records, system, and security owners. Legal, privacy, human resources, regulatory, insurance, and contract owners should approve the rules that fall within their authority, including holds and restrictions on personal or employee data.

The incident coordinator or evidence custodian should apply the rule to each case and record exceptions. No one should dispose of material covered by an active hold merely because the ordinary retention period expired.

Review the schedule when laws, contracts, systems, services, suppliers, storage locations, evidence needs, or incident types change. For each case, check for active investigations, claims, audits, regulator requests, or holds before disposal.

At the end of the approved period, dispose of the record securely unless a documented exception applies. Record the category, authority, date, method, scope, and person responsible without retaining unnecessary copies as proof.

Start with the event or incident record's purpose and retention trigger. An intake report can be retained from closure; a case file from incident resolution; evidence from collection or release of a hold; a notification record from submission, acknowledgement, or final resolution; and a contract-specific record from the event defined by that contract. State the trigger explicitly so the period can be calculated consistently.

Examples of distinct categories include searchable case records, security telemetry, authentication and access logs, communications, regulator submissions, malware samples, forensic images, employee-related records, supplier evidence, and lessons-learned actions. These are examples, not ISO-mandated periods. Each category can require a different owner, repository, access group, integrity control, hold rule, period, and disposal method.