How long should you keep monitoring data? A retention table you can defend
"Keep it forever, it might be useful" is the default in most monitoring deployments, and it is the single easiest thing to fail an audit on. Retention is a decision, not a storage setting. Start from the question the data answers Each module exists to answer something. When the answer no longer needs to exist, the data should not either. That gives a defensible starting point for every table: Data Useful for Suggested retention Working time (logon, active, idle) Payroll accuracy, overtime disputes One payroll cycle plus the statutory look-back for pay claims Application and website usage Workload and tooling decisions 30–90 days in detail, aggregates keep longer Keystroke count Activity trend only 30 days Screenshots Incident review, regulated roles 14–30 days unless held for a specific investigation File transfer and USB records Data-loss forensics 90–180 days Access logs (who saw what) Accountability of the system itself One year Three rules that make ...
