Retention practices are the rules that determine how long logs and other data are kept, where they are stored, and when they are securely deleted. They may be set by an organization’s policies, legal obligations, and the configuration of its systems or services.
In cybersecurity, retention affects both investigations and exposure. Keeping useful logs long enough can help defenders detect intrusions and reconstruct events, while retaining unnecessary data increases the impact of unauthorized access. When adopting a security service, organizations should review its retention periods, storage locations, access controls, deletion procedures, and options for exporting data if they leave the service.