A managed-security vendor contract requires the city to keep related audit logs for seven years. What obligation does that create?
Select an answer to reveal the explanation.
Short Explanation
If the ink on the contract says seven years, the log archive is not a suggestion box. Contractual retention means keep those audit logs for the full term—even when storage teams wish otherwise.
Full Explanation
Contracts can impose retention obligations beyond informal IT preference. When a managed-security vendor contract requires the city to keep related audit logs for seven years, operations must preserve those logs for the agreed period—storage cost does not void the obligation. Contractual retention is a binding civic commitment tied to security monitoring evidence.
Treating the clause as optional guidelines if storage is expensive invites breach of contract. Deleting logs after thirty days to reduce breach impact contradicts the seven-year requirement. Mandating monthly paper printouts of every log line is neither required by the stem nor practical.
Exam caveat: retention drivers include regulatory, contractual, and organizational policy—questions may specify which one. Immutable storage and legal hold features often support long retention.
Operational check: configure log archive retention to ≥seven years for in-scope audit logs, monitor storage growth, restrict delete permissions, and evidence compliance during vendor and internal audits. Test retrieval of a multi-year-old log sample annually so archives remain usable.
FinOps pressure to shrink log storage cannot silently override a seven-year contractual retention for managed-security audit logs—present cost options that still meet the obligation, such as tiered archive with retrieval tests.