STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 6 Release: 4 Benchmark Date: 01 Oct 2025:

The ISSO must ensure application audit trails are retained for at least 30 months (12 months active + 18 months cold storage) for applications without SAMI data and five years for applications including SAMI data.

DISA Rule

SV-222621r1136913_rule

Vulnerability Number

V-222621

Group Title

SRG-APP-000516

Rule Version

APSC-DV-002900

Severity

CAT II

CCI(s)

• CCI-000167 - Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Weight

10

Fix Recommendation

Retain application audit log files for 30 months (12 months active + 18 months cold storage) for non-SAMI data and five years for SAMI data.

Check Contents

Verify a process is in place to retain application audit log files for 30 months (12 months active + 18 months cold storage) for non-SAMI data and five years for SAMI data.

If audit logs have not been retained for 30 months (12 months active + 18 months cold storage) or five years for SAMI data, this is a finding.

Vulnerability Number

V-222621

Documentable

False

Rule Version

APSC-DV-002900

Severity Override Guidance

Verify a process is in place to retain application audit log files for 30 months (12 months active + 18 months cold storage) for non-SAMI data and five years for SAMI data.

If audit logs have not been retained for 30 months (12 months active + 18 months cold storage) or five years for SAMI data, this is a finding.

Check Content Reference

M

Target Key

4093