There is no universal duration.
The duration depends on:
- of the sector
- legal obligations
- contractual obligations
- the risk level
- criticality
- cost
- investigative needs.
An organization must therefore define a retention policy.
The delegated regulation associated with DORA provides, for example, that retention periods are determined taking into account, in particular, security objectives and ICT risk.
It is also necessary to distinguish between:
hot storage
for frequent searches,
And
cold/archive storage for long-term preservation.