Filtering/Firewall Logging Data Retention

[psynegy]

Ahead of our filtering/firewall renewal, I've been trying to find some guidance on how long we should be keeping our students/staff internet browsing logs for, and haven't managed to find anything.

 

Is this just something we make up ourselves, or is there something I've missed?

 

Thanks!

[dmj]

AFAIK it's just a judgment call. IIRC we did about a month, and compressed it wasn't huge amount of data so 90 days wouldn't be unreasonable. Personally I wouldn't go beyond that.

 

In the past (at a former employer) we had notices from the Secretary of State under RIPA laws to log internet connectivity for certain individuals. I wasn't given the details but gather it was related to suspected terrorism.

[psydii]

In my view, in general:

 

If you are logging for potential safeguarding investigations, aligning retention with your CCTV policy seems reasonable.

 

On the other hand if it forms part of an audit trail for cyber security investigations, then 12 months seems reasonable.

 

If there is an active external investigation, you retain them for as long as your legal department tell you they should be retained.

[Steve21]

I’m not sure where it’s from, but as part of our new build being done atm DfE has 12 months requirement of log retention for suppliers to meet

 

Steve

[dmj]

I’m not sure where it’s from, but as part of our new build being done atm DfE has 12 months requirement of log retention for suppliers to meet

 

Steve

 

 

I suspect it's from the RIPA legislation, that upon notification from the home office you would be required to hold data on an individual for a maximum period of 12 month. I guess the DfE took that figure and just made sure that systems have the ability to store 12 months data.

[psydii]

*States at his E5 log retention*

 

Hmm. I’m going to have to stand up that Sentinal stuff aren’t I?