CISA.MS.EXO.17.3 - Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).
Overview
Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).
Rationale: Audit logs may no longer be available when needed if they are not retained for a sufficient time. Increased log retention time gives an agency the necessary visibility to investigate incidents that occurred some time ago. OMB M-21-13, Appendix C, Table 5 specifically calls out Unified Audit Logs in the Cloud Azure log category.
Remediation action
To create one or more custom audit retention policies, if the default retention policy is not sufficient for agency needs, follow Create an audit log retention policy instructions. Ensure the duration selected in the retention policies is at least one year, in accordance with OMB M-21-31.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.17.3 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Audit logging |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1070 Indicator Removal |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.17.3 |
| Criticality | SHALL |
| Upstream requirement | Moved to MS.SECURITYSUITE.5.2v1 (was MS.EXO.17.3v1) |
| Supports controls | cisa-scuba:MS.EXO.17.3, nist-800-53-r5:AU-11 |
| PowerShell test | Test-MtCisaAuditLogRetention |
| Services | ExchangeOnline, Graph, SecurityCompliance |
| Compatible licenses | M365_ADVANCED_AUDITING |