Reports summarizing audit activities shall be retained for a period of six years.</p> </li> <li> <p>Audit log data is retained locally on the audit log server for a one-month period. Beyond that, log data is encrypted and moved to warm storage using automated scripts and is retained for a minimum of one year.</p> </li>