I work for an ASP that provides banking solutions
- Online Banking
- And others
Back Story: Our company provides an "all in one" solution or parts thereof, we are constrained by regulatory agencies. One of the issues that we have run into, is retention. We are pulled in to investigate fraud, fraud-like transactions, etc. Specifically, I have been asked by my Manager about retention of weblogs. His question was centered around the FFIEC 2.0 Refresh. In talking with our Compliance Manager, we could not find anything specific to discuss data retention. Most of the information that I have seen at the FFIEC website is centered around business practices and not IT or Technology. However, when I originally composing this post, I did see a pretty relevant article related to this topic, but is for PCI. I also understand with my question, has very broad brushstrokes in the sense that I opened this regulatory question to not only the Financial sector but Healthcare (HIPPA) as well.
When composing this post, have seen the topic - Data Retention Laws for ISPs in North America as well as What's the best duration for storing e-mail? but this question more inline with specific regulatory agencies as listed below.
Needing to know if there are regulatory requirements for web server log retention for:
We capture login information and we have been advised we need to keep forensic data for at least 365 days and hourly data for at least 30 days.
Could not find anything to substantiate this on the FFIEC website, for example. I am sure there are guides that address this.
Other references related to this Payment Card Industry (PCI) Data Security Standard Page 28
Any other ideas or suggestions?