Filtering and Monitoring log retention

[sigma]

I'm trying (and failing) to find in KCSIE a statement to support log retention periods for filtering/monitoring - either a requirement or guidance.

 

My ISP provided cloud based service only provides me access to a months worth of data.

[GrumbleDook]

The retention period is not strictly mentioned as the logs are only an operational set of temporary records. If any information within the logs is pertinent (e.g. behavioural information), then it should be managed and a copy moved/stored in the appropriate system. If you know you only have 1 month of logs, then you need to adjust your procedures to complete checks on a very regular basis. I would push back on the ISP as the retention period should be your choice, but it does mean you might need to export the data into another system.

KCSiE refers you to the Online Filtering and Monitoring stuff, and that may be beefed out over time ... I'm not aware of anything specific going into the updated Schools Record Management Toolkit, but will ask.

[sigma]

The retention period is not strictly mentioned as the logs are only an operational set of temporary records. If any information within the logs is pertinent (e.g. behavioural information), then it should be managed and a copy moved/stored in the appropriate system. If you know you only have 1 month of logs, then you need to adjust your procedures to complete checks on a very regular basis. I would push back on the ISP as the retention period should be your choice, but it does mean you might need to export the data into another system.

KCSiE refers you to the Online Filtering and Monitoring stuff, and that may be beefed out over time ... I'm not aware of anything specific going into the updated Schools Record Management Toolkit, but will ask.

 

I got into a loop as the Online Filtering and Monitoring stuff also refers you back to KCSiE etc.

 

The ISP keep the logs for 2 years, but don't (currently) provide access to them. I've requested access.

 

I already export my own extracts and do daily checks (because of timeliness), with records moved to appropriate systems as you suggest. There are times when I want to go back to the original sounce to identify exactly when when something I identify as a recent trend started for example.