How does Annex F treat logging retention and secure storage?

• A. Store logs in an unsecured location to save costs.
• B. Retain logs for the required period; store securely with access controls and integrity protections.
• C. Delete all logs after every review.
• D. Keep all logs forever with no protection.

Answer: (B)

Logging retention and secure storage means keeping logs for the period required by policy and protecting them from tampering or unauthorized access. Annex F expects you to retain the logs for the mandated duration so you have enough historical data for investigations and compliance. At the same time, those logs should be stored securely with access controls and integrity protections—think centralized storage, restricted access, encryption at rest and in transit, and methods that verify integrity such as hashing or digital signatures, or an immutable/write-once storage approach. This combination keeps logs usable for audits and incident response while preventing tampering or loss. Unsecured storage, deleting logs after every review, or keeping everything forever without protection all fail to meet these protections and requirements.