The short answer
Preserve audit logs by inventorying each source, exporting the required event population with timestamps, actors, roles, objects, actions, outcomes, and identifiers, protecting integrity and access, and crosswalking source objects to target IDs. Test retrieval with representative and high-consequence events before retiring the source.
Key takeaways
Define the audit questions before exporting logs
Identify the decisions and events that may need reconstruction: balance changes, permission changes, document access, approvals, payment actions, vendor changes, configuration, imports, corrections, and deletions. Record required periods, source systems, environments, and responsible retention or privacy reviewers.
NIST log-management guidance supports source configuration, storage, access, analysis, and representative testing. It is a control reference, not a required retention schedule.
Sample for interpretability, not just file presence
Choose known events with source evidence and ask a reviewer to reconstruct them from the archive.
| Sample class | Question | Required context | Failure signal |
|---|---|---|---|
| Permission change | Who granted what scope? | Actor, role, target, before/after, time | Only final role retained |
| Financial correction | Which record changed and why? | Object IDs, values, action, approval | No source-to-target crosswalk |
| External action | Was a payment/message/work action sent? | Request, provider identity, result | Internal success only |
| Delete/archive | What disappeared and under whose authority? | Object, disposition, actor, policy event | Absence without event |
| Failed attempt | What was attempted but rejected? | Actor, validation, failure outcome | Success-only export |
Accept the archive as an operating record
Verify timestamp and timezone meaning, identity resolution, role-at-event, object crosswalks, ordering limitations, file integrity, access controls, search or query method, and restoration documentation. Retain gaps and unsupported event classes explicitly.
After target go-live, test that new audit events are captured under the approved design. Source preservation and target logging are separate controls; one cannot substitute for the other.
Operational checklist
Mark your progress, then save a working copy. Selections reset when you leave this page. A checked box is not an approval or evidence of completion.
0 of 7 marked
Edge cases
Sources and references
Follow each source to check the underlying claim. Access checks and professional review are different steps.