Audit evidence retention and disposal
as a governed lifecycle on the engagement record, not a shared drive that grows forever
Evidence retention is the part of compliance operations that fails quietly. Artefacts pile up in a shared drive long past their retention floor, expired evidence is kept indefinitely as legal exposure, fresh evidence is destroyed before its retention window closes, and legal holds either over-retain or get forgotten when the matter resolves. Run audit evidence retention and disposal as a lifecycle workflow on the engagement record so each artefact carries a retention class, a disposition date, a legal-hold flag, and a closure path that the activity log captures with timestamp and user attribution.
No credit card required. Free plan available forever.
Govern audit evidence retention and disposal as a lifecycle, not a shared drive that grows forever
Most enterprise compliance programmes capture audit evidence well and retain it badly. Scanner outputs, configuration baselines, signed attestations, access reviews, training records, committee minutes, and policy approvals pile up in shared drives long past any framework retention floor. Disposal cycles run once every two or three years as a clean-up sprint triggered by storage cost. Legal holds are communicated by email and forgotten. Destruction is silent, undocumented, and indistinguishable from a control failure when the audit reads the lookback. The cost is unbounded storage, indefinable legal-discovery exposure, and audit findings that are really documentation failures rather than control failures.
Audit evidence retention and disposal is the operational lifecycle that closes the loop. Each artefact carries a retention class with a documented floor and ceiling, a capture date, a retention end date, and a named disposition owner. Legal holds are explicit overrides on the engagement record. Disposition decisions land on the activity log at the moment of decision with destruction certificates attached. Reconciliation runs quarterly so retention drift is a visible programme metric between audits rather than an audit-week discovery. This use case explains the lifecycle, the failure modes, the policy fields, and how SecPortal runs the discipline on the engagement record. For the per-artefact catalogue, see the audit evidence tracker template. For the upstream signed document that names the per-class retention windows, the legal hold rules, the disposition workflow, and the governance review cadence this lifecycle operates against, see the audit evidence retention policy template. For the staleness analysis that informs retention class choices, see the audit evidence half-life research. For the assessment event itself, see the compliance audits use case. For mapping evidence across frameworks, see the cross-framework control mapping crosswalk workflow. For the related retirement of decommissioned assets and findings, see the asset decommissioning and finding retirement workflow.
Six retention patterns the lifecycle has to handle
Retention is not one decision repeated; it is six recurring patterns that interact. Each pattern starts as a routine compliance task and ends as an audit-week reconstruction problem if the workflow layer is not deliberate.
| Pattern | Healthy posture | Default failure |
|---|---|---|
| Retention floor without retention ceiling | Every artefact carries a retention class with a documented framework-driven floor (the minimum the regulator or auditor expects) and a documented ceiling (the legal-discovery and storage-cost cap above which retention becomes a liability rather than a defence). PCI DSS Requirement 10 sets a twelve-month log floor with three-month online accessibility. ISO 27001:2022 Annex A 5.33 expects records to be protected for the period defined in policy. NIST SP 800-53 AU-11 expects audit-record retention to support after-the-fact investigations. HIPAA Security Rule 164.316(b)(2) expects six years of policy and procedure documentation. The floor and ceiling sit on the engagement record so disposition decisions are bounded rather than open-ended. | Evidence is kept indefinitely because nobody set a ceiling. Twelve years of access reviews, scanner outputs, and configuration baselines accumulate in a shared drive. The retention is technically compliant with every floor but creates legal-discovery exposure no framework requires. The disposal cycle never runs because the ceiling is undefined and every artefact is treated as potentially relevant forever. |
| Retention class stamped at capture, not at audit week | When evidence is captured (a scanner re-run completes, a quarterly access review is exported, a policy is approved, an attestation is signed), it is stamped with its retention class, its capture date, its retention end date, and its named disposition owner. The metadata travels with the artefact in document management or compliance tracking from capture forward so the disposition path is automatic when the retention window closes. | Evidence is captured into a folder structure with no retention metadata. At audit week the team realises the disposition cycle was never running. A senior GRC analyst spends a week classifying years of captured evidence retroactively. Some artefacts get over-classified and are retained too long; some get under-classified and are destroyed before their retention floor. The audit lookback reads the inconsistency as a control failure rather than a documentation failure. |
| Legal hold as an explicit override, not a tribal-knowledge pause | When a regulator opens an inquiry, a litigation matter is filed, an investigation is initiated, or a customer raises a contractual evidence request, every artefact in scope is flagged with a legal hold on the engagement. The hold records the matter reference, the hold owner, the hold start date, the named scope, and the release condition. Artefacts under hold are retained beyond their retention class and surface in the disposition queue with a clear blocker. When the matter resolves, the release is timestamped and the artefact rejoins its retention class on the next disposition cycle. | A legal hold is communicated by email three years ago and never recorded on the engagement. The disposition cycle has been running and over-retaining everything because nobody is sure which artefacts are still on hold. Conversely, a hold was placed on one engagement but the artefacts in scope were destroyed in a clean-up sprint because the hold flag never propagated to the disposition queue. Both shapes produce audit findings and legal exposure. |
| Disposition decision on a documented cadence with named owners | A named GRC or security operations owner reviews disposition candidates on a documented cadence (quarterly is the steady cadence; monthly during heavy disposal cycles or hold-release windows). The review reads the engagement record for artefacts whose retention end date has passed, filters legal-hold flags, confirms the underlying control is still operating, and records the disposition decision with timestamp and user attribution. Disposition is a routine programme event, not a clean-up sprint. | Disposition runs once every two or three years as a clean-up sprint, often triggered by a storage-cost threshold or a turnover event. Decisions made in the sprint are not documented at the moment of decision; the destruction record is reconstructed afterwards from email threads. The audit reads the missing decision record as a control failure even when the underlying disposition was correct against the retention class. |
| Destruction certificate is the closure event, not silent deletion | When evidence reaches the end of its retention window and is destroyed, the activity log captures the destruction reference: the disposal method (cryptographic erasure, secure delete, physical destruction for hardware-bound evidence), the destruction date, the destruction owner, and the matter-resolution note for hold-released artefacts. When evidence is superseded by a fresh capture, the supersession reference points to the replacement. When evidence is retired because the underlying control is decommissioned, the retirement reference points to the asset-decommissioning event. | Evidence is silently deleted from a shared drive without a destruction record. The audit lookback finds the artefact missing from the retention class window and reads the silence as a control failure rather than as a documented disposition. The disposition was correct; the closure event was not captured. The fix is recording the destruction at the moment of decision rather than reconstructing it afterwards. |
| Retention drift is reconciled between audits | A quarterly reconciliation reads the engagement record for artefacts that should have been disposed and were not, artefacts that were disposed before their retention floor, legal holds that have outlasted the matter, and retention classes that have shifted because a framework version updated. The reconciliation report goes to the leadership read alongside coverage and remediation metrics so retention drift is a programme-health indicator rather than an audit-week discovery. | Retention drift is invisible until the next audit. A framework version change (PCI DSS 3.2.1 to 4.0, ISO 27001:2013 to 2022) shifted a retention expectation eighteen months ago and the retention classes were never updated. The audit reads the misalignment as a programme failure even though the underlying controls are operating. The reconciliation has to be a maintained read on the live record rather than an audit-week back-calculation. |
Six failure modes that quietly inflate retention exposure
Retention failures rarely look like failures at the moment they happen. They look like local convenience: an indefinite folder, a clean-up sprint, an emailed legal hold, a silent delete. The cost arrives as unbounded storage, indefinable legal-discovery exposure, and audit findings that read as control failures even when the underlying disposition was correct.
Shared drive grows forever
Without retention classes, every artefact gets the same indefinite shelf. Twelve years of scanner outputs, screenshots, and signed attestations pile up. The disposal cycle never runs because nobody owns it. Storage costs and legal-discovery exposure both grow linearly with time, but the audit-readiness benefit plateaus after the framework retention floor. Treat retention as a class on the artefact at capture, not as a folder structure to clean up later.
Disposal sprint instead of disposal cadence
When the disposition cycle runs once every two or three years as a clean-up sprint, decisions are not documented at the moment of decision. The destruction record is reconstructed afterwards from email threads, sometimes from leaver-account inboxes. The audit reads the missing decision record as a control failure even when the underlying disposition was correct. Run disposition on a quarterly cadence so the activity log captures every decision in real time.
Legal hold communicated by email and forgotten
A hold placed by an email from legal three years ago is the most common over-retention shape. Nobody is sure which artefacts are still in scope. The disposition cycle either over-retains everything to be safe or destroys artefacts that should still be on hold. Record holds on the engagement as explicit overrides with named scope, hold owner, and release condition so the disposition queue can read the hold flag rather than a leaver inbox.
Retention class is implicit per framework, not explicit per artefact
A programme that operates against five frameworks defaults to "keep everything for the longest framework retention" and never sets per-artefact classes. Activity logs that need twelve months for PCI DSS Requirement 10 are kept for seven years for HIPAA-aligned policy reasons. Configuration screenshots that need three years for SOC 2 are kept indefinitely. The implicit policy generates indefensible retention because the audit asks for the per-artefact class and the team cannot point to one.
Destruction without a documented certificate
Evidence is silently deleted from a shared drive when storage runs short or a folder is reorganised. There is no destruction reference, no disposition decision, no activity-log entry. The audit lookback reads the silence as a control failure even when the underlying disposition was correct against the retention class. The fix is capturing the destruction reference (method, date, owner, matter-resolution note) on the activity log at the moment of disposal.
Framework version changes silently shift retention expectations
When PCI DSS 3.2.1 moved to 4.0, when ISO 27001:2013 moved to 2022, when NIST SP 800-53 Rev 4 moved to Rev 5, retention expectations shifted in subtle ways. Programmes that did not consume the version change as a retention-class update carry stale retention windows for eighteen or twenty-four months. Retention drift has to be an item on the framework version-transition checklist alongside control mapping, evidence cadence, and audit narrative updates.
Six fields every retention policy has to record
A defensible retention lifecycle is six concrete fields on the engagement record, not an abstract paragraph in a GRC handbook. Anything missing from the list below is a known gap in the retention discipline rather than a detail that will surface later.
Retention class catalogue
Each retention class records the floor (framework-driven minimum), the ceiling (legal-discovery and storage-cost cap), the default disposition rule (destroy, archive, supersede, retire), and the named owner. Classes typically include audit-log retention (twelve months minimum, often seven years for healthcare and seven for financial services), control-evidence retention (three to seven years depending on framework), policy-document retention (six years for HIPAA, often longer for ISO certification cycles), and engagement-deliverable retention (varies with contract terms). The catalogue is the basis for the per-artefact stamp.
Per-artefact retention metadata
Every artefact captured into document management or compliance tracking is stamped with its retention class, its capture date, its retention end date, the framework references the artefact supports, and the named disposition owner. The metadata travels with the artefact from capture so the disposition path is automatic when the retention window closes. Capture without metadata is the source of indefinite drift; the metadata stamp is the discipline that closes the lifecycle.
Legal-hold register
Every active hold records the matter reference, the hold owner, the hold start date, the named scope (engagement, control, asset, finding, time period, or jurisdiction), and the release condition. Artefacts in scope of an active hold surface in the disposition queue with the hold flag and are not eligible for destruction until the hold is released. The register is the override the disposition cycle reads alongside the per-artefact retention metadata.
Disposition decision template
Each disposition decision records the artefact reference, the linked control, the retention class, the disposition type (archive inside retention, destroy, supersede, retire), the disposition method (for destroyed artefacts), the disposition date, the disposition owner, and the matter-resolution note for hold-released artefacts. The decision template is the activity-log entry that produces a reproducible disposition record.
Reconciliation cadence and owner
A named GRC or security operations owner reviews retention drift on a documented cadence (quarterly is the steady cadence; monthly during heavy disposal or hold-release windows). The reconciliation reads artefacts that should have been disposed and were not, artefacts that were disposed before their retention floor, legal holds that have outlasted the matter, and retention classes that have shifted because of framework version changes. The reconciliation report goes to the leadership read so retention drift is visible between audits.
Framework-version-transition rule
When a framework releases a new version (PCI DSS 4.0, ISO 27001:2022, NIST CSF 2.0, NIST SP 800-53 Rev 5, HIPAA updates), the transition checklist includes a retention-class review alongside the control mapping update. Retention floors and ceilings that have shifted are recorded against the new framework references. Existing artefacts inherit the new retention class going forward; in-flight artefacts retain their original capture-time class to preserve audit reproducibility.
Retention and disposal checklist
Before any artefact is captured, any disposition runs, any legal hold is placed, or any framework version transition is consumed, the GRC owner, the security lead, and the audit liaison walk through a short checklist. Each item takes minutes; missing any one of them is the source of the failure modes above and the unbounded retention drift that follows.
- The retention class catalogue is documented on the engagement and reviewed at least annually.
- Every artefact captured into document management or compliance tracking is stamped with its retention class, capture date, retention end date, and named disposition owner.
- No artefact lands in the live record without a retention class; capture without metadata is treated as a control event.
- Legal holds are recorded on the engagement with matter reference, hold owner, scope, and release condition rather than communicated by email.
- Artefacts in scope of an active legal hold surface in the disposition queue with a clear blocker and are not eligible for destruction until the hold is released.
- Disposition reviews run on a documented quarterly cadence with the disposition decision recorded on the activity log at the moment of decision.
- Destruction is recorded with method, date, owner, and matter-resolution note for hold-released artefacts; silent deletion is a control event.
- Supersession references point to the replacement artefact so the audit lookback can follow the evidence lineage.
- Retirement references tie disposed evidence to the corresponding asset-decommissioning or control-decommissioning event.
- Quarterly reconciliation reads retention drift (over-retained, under-retained, hold-outlasted-matter, version-transition mismatches) and reports it to the leadership cadence.
- Framework version transitions include a retention-class review on the transition checklist.
- Activity log entries capture every disposition decision, hold placement, hold release, and retention-class change with timestamp and user attribution.
- AI-generated reports derive the retention narrative from the live engagement record rather than from per-framework prose written at audit week.
- A successor reviewer can read the retention lifecycle for any artefact end-to-end without speaking to the original owner.
How retention discipline runs in SecPortal
Retention discipline runs on the same feature surfaces the rest of the security and compliance programme already uses: the engagement record, document management, compliance tracking, the activity log, findings management, and AI reporting. The discipline is keeping the per-artefact retention metadata, the legal-hold register, and the disposition decisions on the live record so the retention story derives from one operating record rather than from a shared drive that nobody owns.
Retention class on the engagement
The retention class catalogue, the legal-hold register, and the disposition cadence sit on the engagement record. Artefacts inherit the class so disposition is automatic when the retention window closes rather than a manual triage at audit week.
Artefacts stamped at capture
Document management holds the per-artefact metadata: retention class, capture date, retention end date, framework references, and named disposition owner. Capture without metadata is treated as a control event so the retention path is bounded from the moment of capture.
Framework view per retention class
Compliance tracking renders the retention class catalogue as separate framework views for ISO 27001, SOC 2, PCI DSS, NIST, HIPAA, and any sector overlay so each audit reads the per-framework retention floor against the live record rather than a shared-drive reconstruction.
Findings reflect into retention
Findings management holds finding closure and retest evidence with the linked retention class. Closure evidence inherits the retention class of the underlying control rather than carrying a shorter or longer window by accident.
Reports derive from the live record
AI-generated reports produce per-framework retention narratives and disposition summaries from the same engagement record. The retention answer the audit reads is the same answer the leadership cadence reads, with no parallel spreadsheet authored at audit week.
Audit trail in the activity log
Every disposition decision, every legal hold placement, every release, every destruction certificate, and every retention class change lands on the activity log with timestamp and user attribution. The CSV export is the maintenance trail every external assessor can read alongside the disposed evidence.
Five reporting views the lifecycle drives
The reports that drive retention discipline are not the static destruction log that lands at audit close. They are the live views security leads, GRC owners, and audit committees use between assessments. The five below are the ones every multi-framework programme settles on, and they all derive from the live engagement record rather than a parallel spreadsheet.
Disposition queue
Artefacts whose retention end date has passed, with legal-hold flags, named disposition owners, and recommended disposition type. The view that drives the quarterly disposition cadence rather than the audit-week clean-up sprint.
Active legal-hold register
Every active hold with matter reference, scope, hold owner, hold start date, and release condition. The view that prevents emailed-and-forgotten holds from turning into unbounded over-retention or accidental destruction of in-scope artefacts.
Destruction register
Every disposition decision with method, date, owner, and matter-resolution note. The view that produces a defensible destruction record for any audit lookback rather than silent deletion that reads as a control failure.
Retention drift reconciliation
Over-retained artefacts, under-retained artefacts, holds outlasting matters, and retention class mismatches from framework version transitions. The quarterly view that keeps drift visible between audits rather than discovered at the next assessment.
Activity log export
Every retention class change, hold placement, hold release, disposition decision, and destruction certificate with timestamp and user attribution. The CSV export the audit lookback reads alongside the disposed evidence.
What auditors expect from retention and disposal
Retention evidence shows up in audit reads whenever an external assessor reviews a programme that operates against any framework with a documented retention expectation. The frameworks below all expect the programme to demonstrate that artefacts are retained on a documented class, disposed on a documented decision, and held under named legal holds when an active matter is in scope.
| Framework | What the audit expects from retention |
|---|---|
| SOC 2 (CC4.x, CC7.x) | SOC 2 Type 2 expects evidence to populate the audit observation period (commonly six to twelve months) and to be retained inside the agreed system description. The CC4 monitoring criteria and CC7 detection criteria expect ongoing operation, so evidence has to remain reproducible across the observation period. A retention class that aligns to the observation period plus the agreed carry-forward window (commonly two to three years) lets the next observation period inherit the prior period evidence rather than reset. |
| ISO 27001 (Clause 7.5, Annex A 5.33) | ISO 27001:2022 Clause 7.5.1 expects documented information to be controlled and retained for a period defined in policy. Annex A 5.33 expects records to be protected from loss, destruction, falsification, unauthorised access, and unauthorised release. A retention class that records the certification cycle (three years plus surveillance audits, often kept seven) lets the surveillance audit and recertification audit inherit the prior cycle evidence with the chain-of-custody record intact. |
| PCI DSS (Requirement 10, Requirement 12) | PCI DSS Requirement 10.5.1 requires audit logs to be retained for at least one year, with three months immediately available for analysis. Requirement 12 expects security policy documentation, training records, and incident response evidence to be retained for the assessment lookback. PCI DSS 4.0 strengthened several retention expectations and introduced customised approaches that record retention rules explicitly. A retention class per artefact type lets the QSA read the retention floor against the live record rather than a per-folder reconstruction. |
| NIST SP 800-53 (AU-11, MP-6, SI-12) | NIST SP 800-53 AU-11 expects organisations to retain audit records for a period consistent with the records-retention policy and to support after-the-fact investigations. MP-6 expects sanitisation of media before disposal or release. SI-12 expects information handling and retention to be consistent with applicable laws, regulations, standards, and policies. A documented retention class catalogue with sanitisation methods recorded on the disposition decision is the artefact the assessor reads against the AU-11, MP-6, and SI-12 expectations. |
| HIPAA Security Rule (164.316(b)(2)) | HIPAA Security Rule expects covered entities and business associates to retain documentation required by the Security Rule for six years from the date of creation or the date when last in effect, whichever is later. Audit logs, access reviews, sanction policies, training records, and incident response evidence all fall in scope. A retention class that records the six-year floor with the date-anchor distinction (creation vs last-in-effect) lets HIPAA assessments read the per-artefact retention against the policy. |
| Sector overlays (FedRAMP, FFIEC, NIS2, DORA, GDPR Article 5) | Regulated sector overlays add retention expectations on top of baseline frameworks. FedRAMP inherits NIST SP 800-53 with federal-record schedules. FFIEC examination-record retention varies by examination type. NIS2 and DORA expect incident-record retention against the operational-resilience programme. GDPR Article 5(1)(e) expects personal-data retention to be limited to the period necessary for the purpose, which interacts with longer audit-record floors and produces a balancing decision rather than a single rule. The retention class catalogue records the overlay-specific floors and the data-minimisation balancing decisions so the retention lifecycle is defensible under each overlay. |
Where retention discipline sits in the wider programme
Retention discipline composes with the rest of the security and compliance programme on the same engagement record so the per-artefact retention metadata stays connected to the controls producing the evidence and the audit reads consuming it.
Upstream and adjacent
Retention sits downstream of the compliance audits workflow (the audit produces the evidence retention is governing) and upstream of the asset decommissioning workflow (a retired asset triggers retention class transitions on its evidence). It composes with the cross-framework control mapping crosswalk workflow because one retention class applies across many framework citations.
Downstream and reporting
Retention rolls up into the security leadership reporting workflow where the disposition queue, active legal holds, destruction register, and retention drift reconciliation all become headline indicators on the leadership cadence. The control gap remediation workflow consumes retention failures (missing evidence, expired evidence) as control gaps with named owners and closure plans, and the research on audit evidence half-life informs the retention class decisions the catalogue records. The carrier-facing read of the same retained evidence at policy renewal and at claim time lives on the cyber insurance security evidence workflow, so the same retention catalogue answers the audit and the underwriter.
Pair the workflow with the long-form guides and framework references
Retention discipline is operational; the surrounding guides explain the framework retention expectations and evidence theory the workflow has to satisfy. Pair this workflow with the security compliance automation guide for the broader compliance operating model, the ISO 27001 audit checklist for the certification cycle that drives one of the longer retention bands, the SOC 2 compliance guide for the observation-period model that sets the SOC 2 retention expectation, the PCI DSS assessment guide for the Requirement 10 log retention floor, and the cybersecurity risk assessment guide for the residual-risk view retention contributes to. The framework references the lifecycle most often spans include ISO 27001, SOC 2, PCI DSS, NIST SP 800-53, HIPAA, FedRAMP, GDPR, NIS2, and DORA.
Buyer and operator pairing
Retention and disposal discipline is the workflow GRC and compliance teams run as the spine of an audit-ready programme, internal security teams run alongside vulnerability management and exception management, security operations leaders run as part of the operating cadence, and CISOs read at the leadership cadence as a programme-health indicator. The compliance consultants and virtual CISOs who run programmes on behalf of clients use the same lifecycle so the disposition decisions outlast the engagement contract. Templates that support the workflow include the audit evidence tracker template for the per-entry catalogue, cybersecurity risk register template for the underlying risk-treatment record, security exception register template for deferred-risk evidence retention, and the vulnerability management programme scorecard for the cross-cutting maturity read.
What good retention discipline feels like
Every artefact carries a class
Capture stamps the artefact with retention class, capture date, retention end date, and named disposition owner. Capture without metadata is treated as a control event so the shared drive cannot grow forever by accident.
Holds are explicit overrides
Every legal hold is recorded on the engagement with matter reference, scope, owner, and release condition. Holds communicated by email and not on the engagement are treated as documentation gaps to close, not as in-flight overrides to honour.
Disposition is a cadence
Quarterly disposition reviews run on the live record with named owners, recorded decisions, and destruction certificates captured at the moment of disposal. The clean-up sprint becomes a routine cadence the audit can read.
Retention drift is visible
Over-retention, under-retention, hold-outlasted-matter cases, and framework version-transition mismatches are reported at the quarterly leadership cadence rather than discovered at the next external assessment.
Audit evidence retention and disposal turns the unbounded shared drive into a governed lifecycle. Run the workflow on the engagement record so each artefact carries a retention class at capture, every legal hold is an explicit override on the live record, every disposition decision is captured at the moment of decision with timestamp and user attribution, and quarterly reconciliation keeps retention drift visible between audits. The audit reads stay reproducible from one record rather than from a shared-drive reconstruction, and the team scales with the programme rather than with the storage footprint.
Frequently asked questions about evidence retention and disposal
What is audit evidence retention and disposal?
Audit evidence retention and disposal is the operational lifecycle that governs how long compliance evidence is kept, who can access it during retention, when it is disposed, and how the disposition is documented. Retention is the period the artefact is kept against the framework floor and the legal-discovery ceiling. Disposal is the closure event that destroys, archives, supersedes, or retires the artefact at the end of the retention window. The lifecycle records each artefact with its retention class, capture date, retention end date, named owner, and disposition decision so the audit walk can read the retention story for any artefact end-to-end without speaking to the original owner.
How is retention different from the audit evidence tracker template and the audit evidence half-life research?
The audit evidence tracker template is the per-entry artefact catalogue that records the metadata for each artefact (control reference, source system, currency, owner, retention class). The audit evidence half-life research analyses why evidence loses persuasive value over time across the cadence and change axes. Retention and disposal is the lifecycle workflow that consumes both: the tracker captures the per-entry metadata, the half-life research informs the retention class decision, and the lifecycle workflow runs the scheduled disposition reviews, legal holds, destruction certificates, and reconciliation cadence on the engagement record. The three artefacts compose; one does not replace another.
What retention periods do the major frameworks expect?
PCI DSS Requirement 10.5.1 expects audit logs retained for at least twelve months with three months online. SOC 2 Type 2 evidence falls inside the observation period (six to twelve months) plus the carry-forward window (commonly two to three years). ISO 27001:2022 expects records protected for the period defined in policy, typically aligned to the certification cycle (three years plus surveillance, often kept seven). NIST SP 800-53 AU-11 defers to organisational policy with the expectation that records support after-the-fact investigation. HIPAA Security Rule 164.316(b)(2) expects six years from creation or last-in-effect. Sector overlays (FedRAMP, FFIEC, NIS2, DORA) layer on top with overlay-specific floors. The retention class catalogue records the per-framework floors so the per-artefact stamp picks the strictest applicable class.
How should the workflow handle legal holds?
Legal holds are recorded on the engagement as explicit overrides that suspend scheduled disposal. The hold registers the matter reference, the hold owner, the hold start date, the named scope (engagement, control, asset, finding, time period, jurisdiction), and the release condition. Artefacts in scope surface in the disposition queue with a clear blocker and are not eligible for destruction. When the matter resolves, the release is timestamped on the engagement and the artefact rejoins its retention class on the next disposition cycle. Holds communicated by email and not recorded on the engagement are the most common over-retention failure shape; explicit holds on the live record are the discipline that produces a defensible retention answer.
How often should disposition reviews run?
Quarterly is the steady cadence for most enterprise programmes. Disposition reviews run more frequently (monthly) during heavy disposal cycles, large hold-release windows, or framework version transitions that shift retention expectations. The disposition review reads the engagement record for artefacts whose retention end date has passed, filters legal-hold flags, confirms the underlying control is still operating, and records the disposition decision with timestamp and user attribution. Disposition that runs as a one-off clean-up sprint every two or three years fails audit reads because the destruction record is reconstructed afterwards rather than captured at the moment of decision.
What goes into a destruction certificate?
A destruction certificate records the artefact reference, the linked control, the retention class, the disposition method (cryptographic erasure, secure delete, physical destruction for hardware-bound evidence), the destruction date, the destruction owner, and the matter-resolution note for hold-released artefacts. The certificate lands on the activity log at the moment of disposal so the audit lookback reads a documented closure rather than silence. Silent deletion is the failure shape the destruction certificate prevents.
Does SecPortal automatically delete evidence at the retention end date?
No. The disposition decision is yours to make on the engagement record. SecPortal does not delete document-management or compliance-tracking artefacts on a schedule and does not synthesise retention classes from raw artefact text. SecPortal does make the lifecycle operational by letting the per-artefact retention class, the legal-hold register, the disposition decision, the destruction certificate, and the reconciliation cadence all derive from the same engagement record so the retention story stays in sync with the live programme rather than drifting into a shared drive that grows forever.
How does retention interact with GDPR data minimisation?
GDPR Article 5(1)(e) expects personal data to be retained only for the period necessary for the purpose. Audit evidence often contains personal data (access reviews include user identifiers; activity logs include actor names; incident records include affected individuals) that has a longer retention floor under audit frameworks than under GDPR. The retention class catalogue records the balancing decision: the audit floor wins for the audit-relevant fields, the GDPR minimisation rule wins for the personal-data fields not needed for the audit purpose. Pseudonymisation and field-level redaction are common controls that let the audit retention proceed without retaining the personal data beyond the GDPR purpose. The balancing decision is documented on the engagement so the lifecycle is defensible under both regimes.
How does retention reflect a framework version transition?
When a framework releases a new version (PCI DSS 3.2.1 to 4.0, ISO 27001:2013 to 2022, NIST SP 800-53 Rev 4 to Rev 5, HIPAA updates), the transition checklist includes a retention-class review alongside the control mapping update. Retention floors or ceilings that shifted are recorded on the new framework references. Existing artefacts captured under the prior class retain the prior class to preserve audit reproducibility for the prior assessment cycle. New artefacts captured after the transition inherit the updated class. The crosswalk records the version-to-version retention delta so the next assessment cycle reads consistent retention against the new framework.
Who owns the retention lifecycle?
A named GRC or security operations owner on the named team owns the retention lifecycle as a maintained record on the engagement. The owner reviews disposition candidates on the documented cadence, manages the legal-hold register with the legal team, captures destruction certificates at the moment of disposal, runs the quarterly reconciliation, and updates the retention class catalogue when framework versions transition. Without a named owner the lifecycle ages into an unbounded shared drive within a year. The retention answer is only as reliable as the maintenance cadence behind it, so the owner is named in the policy alongside the catalogue itself.
How it works in SecPortal
A streamlined workflow from start to finish.
Define retention classes that match every framework the programme operates against
Before any evidence is captured, the programme records the retention classes the lifecycle has to support. SOC 2 audit evidence sits inside the observation period plus the carry-forward window the auditor expects (commonly two to three years). ISO 27001 evidence covers the certification cycle (three years plus surveillance audits, often kept seven). PCI DSS Requirement 10 logs and Requirement 12 evidence carry minimum-twelve-month retention with three-month online accessibility. NIST SP 800-53 AU-11 and HIPAA Security Rule expect seven-year retention for audit logs in healthcare. Each retention class records the floor (the framework-driven minimum), the ceiling (the legal-discovery exposure cap), and the default disposition rule. Without classes, every artefact gets the same indefinite shelf and the lifecycle never closes.
Stamp every evidence artefact with its retention class at capture
When a scanner re-run, a configuration baseline, an attestation, an access-review export, an activity-log snapshot, or a policy document lands in document management or compliance tracking, it is stamped with its retention class, its capture date, its retention end date, and the named owner responsible for the disposition decision. Evidence captured without a class is the most common failure shape and is the single biggest source of unbounded retention drift. Every artefact carries the metadata at capture so the disposition path is automatic when the retention window closes rather than a manual triage exercise during a clean-up sprint.
Apply legal holds as an explicit override that suspends scheduled disposal
When a regulator opens an inquiry, a litigation matter is filed, an investigation is initiated, or a customer raises a contractual evidence request, every artefact in scope is flagged with a legal hold that overrides the scheduled disposition. The hold records the matter reference, the hold owner, the hold start date, and the named scope (engagement, control, asset, or finding). Artefacts under hold are retained beyond their retention class and surface in the disposition queue with a clear blocker rather than expiring silently. When the matter resolves, the hold is released with a timestamp and user attribution, and the artefact rejoins its retention class on the next scheduled disposition cycle.
Run scheduled disposition reviews on a documented cadence
A named GRC or security operations owner reviews disposition candidates on a documented cadence (quarterly is the steady cadence; monthly during heavy disposal cycles). The review reads the live engagement record for artefacts whose retention end date has passed, filters legal-hold flags, confirms the underlying control is still operating, and records the disposition decision (archive inside retention, destroy, supersede, retire). Each disposition lands on the activity log with timestamp and user attribution so the lifecycle is reproducible to a successor reviewer. Disposition reviews that run as one-off clean-up sprints fail audit reads because the destruction record is not documented at the moment of decision.
Capture destruction certificates and supersession references for the disposed record
When evidence is destroyed at the end of its retention window, the activity log captures the destruction reference (the disposal method, the destruction date, the destruction owner, and the matter-resolution note for hold-released artefacts). When evidence is superseded by a fresh capture rather than destroyed, the supersession reference points to the replacement artefact so the audit lookback can follow the lineage. When evidence is retired because the underlying control is decommissioned, the retirement reference points to the asset-decommissioning event so the closure is traceable. The destroyed-but-undocumented case is the failure shape that produces audit findings; the destruction record has to live on the engagement at the moment of decision rather than be reconstructed afterwards.
Reconcile retention against the live programme between audit cycles
The retention lifecycle is a maintained record, not a one-off clean-up. Quarterly reconciliation reads the engagement record for artefacts that should have been disposed and were not, artefacts that were disposed before their retention floor, legal holds that have outlasted the matter, and retention classes that have shifted because a framework version updated (PCI DSS 4.0 retention changes, ISO 27001:2022 references). The reconciliation report goes to the leadership read alongside coverage and remediation metrics so retention drift is visible as a programme-health indicator rather than discovered as an audit finding.
Features that power this workflow
Run retention and disposal on the engagement record
Stamp every artefact with a retention class, suspend disposition under legal hold, run scheduled disposition reviews, and record destruction with timestamp and user attribution. Start free.
No credit card required. Free plan available forever.