What does retention of audit logs 'per policy' imply?

• A. Logs are retained per policy, as dictated by organizational policy and regulatory requirements.
• B. Logs are retained indefinitely.
• C. Logs must be discarded after 1 day.
• D. Logs are stored privately on employee devices.

Answer: (A)

Retention of audit logs per policy means there is a formal policy that specifies how long logs are kept, where they are stored, who can access them, and when they are destroyed. This ties logging practices to organizational rules and any applicable laws or regulations, ensuring an auditable and compliant trail while avoiding unnecessary storage. The exact retention duration is defined by the policy and can vary based on data sensitivity and legal requirements, but it is always governed by documented guidelines rather than being arbitrary. In practice, logs are typically kept in a centralized, secure repository to protect integrity and confidentiality, rather than being stored privately on employee devices.