CISA ties log retention to the purpose, not to ninety days

A fixed period of ninety days is not an official standard for AI incident investigation. CISA, NIST and OMB tie retention periods to investigative purpose, risk and regulation, with federal rules already requiring at least six months of actively searchable and one year of retrievable logs; so determine per log type which incident questions it must answer.

CISA published its Logging Reference Architecture on 20 August 2026. The architecture distinguishes between actively searchable storage for operational monitoring, retrievable retention for later investigation, and separately protected evidentiary data for forensic or legal purposes. Nowhere does it set a universal retention period of ninety days. That period may occur within organisations or products as an internal operational setting, but the official frameworks supplied do not turn it into a universal standard.

That distinction matters to anyone who manages AI systems. In our analysis, treating a ninety-day default as though it were an official standard creates a false sense of certainty: for an incident that only comes to light after several months, the relevant logs will by then already have been overwritten.

What does the CISA Logging Reference Architecture say about log retention periods?

CISA describes a distinction between actively searchable, retrievable and separately protected evidentiary storage, and ties retention to the purpose rather than to a single number. The document refers to the federal baseline from OMB memo M-26-14: logs must remain at least six months actively searchable and one year retrievable. For AI systems, CISA identifies context such as prompts, model outputs, model versions, agent decisions, tool calls and other runtime parameters as information organizations should consider logging.

The storage functions CISA describes include:

• Actively searchable storage for fast detection and triage, in which logs are directly queryable.
• Retrievable retention for later reconstruction, in which data is kept longer but is not continuously live.
• Separately protected evidentiary datasets for investigation or legal assessment, with stricter integrity and access requirements.

The OMB memo M-26-14 from the Executive Office of the President provides the policy basis underpinning this architecture and requires reliable timestamps, sufficient log context and availability for investigation. That memo too contains no ninety-day standard.

Which logs do I need to reconstruct an AI incident involving agents?

You need more than just the alert that something went wrong. To reconstruct unexpected agent behaviour you must be able to trace the full trajectory and be able to demonstrate that this data was not altered. NIST CAISSI, NSA SISC and CISA set out in their practices for incident readiness that logs must be tamper-resistant and must carry reliable timestamps.

For a practical reconstruction record, organizations should consider capturing at least:

• model and system identity and the exact version that was active;
• prompts, outputs and the relevant environment state;
• tool calls, agent actions and reasoning traces where available;
• access decisions and security decisions;
• security monitoring, timestamps and configuration changes;
• human interventions during the incident;
• which data has been minimised or masked, so that later it is clear what is missing and why.

This is an operational recommendation based on the frameworks, not a verbatim minimum imposed by them. The NIST-NSA-CISA practices emphasise that after a control incident an organisation first collects, preserves and analyses evidence, and only resumes operation after verified recovery. In our analysis, the retention period is therefore a function of reconstruction and containment, not of a stand-alone number. A playbook for control incidents involving AI agents works out that sequence further.

Why is ninety days too short as a general retention period?

Because the official frameworks require longer and because the period within which AI incidents come to light does not stick to ninety days. The federal baseline in M-26-14 requires six months actively searchable and one year retrievable. According to the research supplied, high-risk AI under the EU AI Act requires at least six months for automatically generated logs under the control of the provider or deployer; before publication, check the precise applicable provision and any longer statutory periods.

Three different things are in practice conflated:

1. an internal retention setting of ninety days, often the default of a logging platform;
2. a legal minimum period, such as the six months under the EU AI Act or the federal baseline;
3. a risk-driven forensic retention need, which determines how long you must be able to reconstruct a specific incident.

In our assessment the greatest risk is not that organisations log too little, but that they keep the wrong logs for too short a time: the triage logs remain live, while the agent and tool-call traces that carry an investigation have already been rotated out.

What does this mean for directors, lawyers and CISOs who are setting retention policy now?

Our analysis: because CISA splits logging into searchable, retrievable and evidentiary storage, a single ninety-day retention dial no longer suffices; so the CISO should, before implementation, record per log type which incident question it must be able to answer and for how long. Because the EU AI Act and M-26-14 establish six-month-related requirements in their respective scopes—high-risk AI systems covered by the Act and U.S. federal agencies covered by the memo—retaining less may create a compliance issue where those requirements apply; the applicable scope and any longer requirements must be checked before adoption, so the lawyer should test the retention policy against the applicable minimums before it is adopted. Our recommendation is that organizations establish an incident hold that suspends normal deletion when a relevant investigation starts, particularly where delayed discovery is reasonably possible. Because the NIST-NSA-CISA practices call for tamper-resistant logs with reliable timestamps, our recommendation is that an export without a documented integrity check should not be treated as a complete evidentiary record; the board should also test whether integrity, access, privacy and recovery work in practice rather than merely exist on paper.

Summarised as a decision:

• determine before implementation which incident questions must be answered and which records are needed for that;
• establish per log type what must remain actively searchable and what need only be retrievable;
• test the periods against the legal minimums that apply to your AI application;
• record an incident hold that suspends normal deletion;
• periodically test the integrity, access, privacy and recoverability of the retained logs.

Whoever links these steps to the distinction between record a technical event and a linked decision record and to controlling tool calls and authorisation of AI agents builds retention that genuinely carries an investigation. More background is in the topic hub on AI security and controlling AI systems.

Sources: The article draws on the CISA Logging Reference Architecture, the joint NIST-NSA-CISA practices for incident readiness and OMB memo M-26-14.