SQL servers auditing to storage accounts should have retention set to 90 days or more

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 4 Business continuity and crisis management
• 6 Security in network and information systems acquisition, development and maintenance
• 12 Asset management

NIST SP 800-53 Rev 5

• Audit Record Retention (AU-11)

NIST Cybersecurity Framework v2.0

• RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved.

FedRAMP Moderate Baseline Rev 4

• AU-11: Audit Record Retention

NIST SP 800-171 Rev 2

• 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions

RBI Cyber Security Framework for UCBs

• Annex I (7.4)

RBI IT Framework for NBFCs

• 3.1.g Trails

BSI C5:2025

• OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
• OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
• OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.

CIS Azure Benchmark v2.0.0

• 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'

CIS Azure Benchmark v2.1.0

• 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'

CIS Azure Benchmark v3.0.0

• 5.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days'

CMMC 2.0 Level 2

• AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
• AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(D): Administrative Safeguards
• 164.312(b) Audit controls