{"data":{"id":"AU-04","name":"Audit Log Storage Capacity","family":"AU","family_name":"Audit and Accountability","withdrawn":false,"description":"Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].","supplemental_guidance":"Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.","enhancements":[{"id":"AU-04(01)","name":"Transfer to Alternate Storage","statement":"Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AU-04","name":"Audit Log Storage Capacity","description":"Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].","discussion":"Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.","related_controls":["AU-02","AU-05","AU-06","AU-07","AU-09","AU-11","AU-12","AU-14","SI-04"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Adds ’Log’ to title Changes parameter text from ‘record storage’ to ‘log retention’"}},"compliance_mappings":{"iso_27001_2022":["7.5","A.8.6","A.8.15"],"iso_27002_2022":["8.6","8.15"],"cobit_2019":["BAI04"],"pci_dss_v4":[],"nist_csf_2":["PR.IR-04"],"cis_controls_v8":["CIS 8","CIS 8.3"],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":["3-3 SR 2.9","3-3 SR 7.2"],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.5"],"anssi":["Hygiene.29","SecNumCloud.13.7"],"osfi_b13":["B-13.3.3"],"finma_circular":["IV.A(28)","IV.A(29)","IV.C(66)"],"gdpr":["Art.5(1)(e)","Art.30(1)"],"dora":["Art.10(1)"],"bio2":["8.6","8.15"],"rbi_csf":["Annex1.16","ITGRCA.15"],"fisc":["FISC.O11","FISC.O13"],"lgpd_bcb":["BCB.Art.9","BCB.Art.20"],"hkma_tme1":["TME1.5.2","TME1.5.3"],"mlps_2":[],"dnb_good_practice":["DNB.18.1"],"cra":["CRA.I.2l"],"swift_cscf":[],"cbb_tm":["TM-5","TM-12"],"cbuae":["CR-3"],"nca_ecc":["2-12"],"qatar_nia":["OS"],"uae_ia":["T7"],"bog_cisd":["CISD-VII"],"bom_ctrm":["4.2"],"cbe_csf":["CD-1"],"cbn_csf":["Part3.5"],"sa_js2":["JS2-7.3"],"bcbs_239":["Principle 5"],"bot_cyber":["Ch3.1"],"cpmi_pfmi":["CG.DE"],"eba_ict":["3.4.5"],"ecb_croe":["CROE.2.4"],"ffiec_is":["III.B"],"hipaa_sr":["§164.312(b)"],"iosco_cyber":["DET-1"],"nydfs_500":["500.6"],"sebi_cscrf":["DE.AU"],"cmmc_2":["AU"],"nerc_cip":[],"nrc_73_54":["RG5.71-A-AU"],"tsa_psd":[],"ieee_1686":["5.2"],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FAU"],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":["§11.10(e)"],"fda_cyber":["SA-5"],"hitrust_csf":["09.g"],"iso_27799":["12.4"],"lloyds_ms":["MS8.12"],"naic_ds":["4-audit"],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":["SEC-CD-15"],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"detective","used_by_patterns":["SP-001","SP-002","SP-016","SP-019","SP-031"]}}