[Autogenerated] audit log files have to use is,
firstly,
to look for anomalies and suspicious activities as they happen in real time.
And secondly,
to allow on organization to go back in time on
undertake historical analysis off events,
often after an instance happened.
Now,
Requirement 10.7 supports this second use by requiring the
retention of log files for 12 months.
The actual requirement is slightly more detailed because not only
does it want log files retained for 12 months,
the previous three months need to be retained online.
Rather needing to be restored from some something like backup meet media.
The USSA is going to look at policies and procedures and also interview
people responsible for the maintenance of historical log files to make
sure that 12 months in total like app and that the last three months are
online and instantly available,
then also actually look at the log files to make sure that this is the case