CISA.MS.EXO.17.3: Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).
| ID | CISA.MS.EXO.17.3 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Audit logging |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.17.3 (SHALL) |
| Framework controls | cisa-scuba:MS.EXO.17.3nist-800-53-r5:AU-11 Audit Record Retention |
| MITRE ATT&CK | T1070 |
| Reads from | Exchange Online, Microsoft Graph, Security & Compliance PowerShell |
| Licence needed | M365_ADVANCED_AUDITING |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).
Rationale: Audit logs may no longer be available when needed if they are not retained for a sufficient time. Increased log retention time gives an agency the necessary visibility to investigate incidents that occurred some time ago. OMB M-21-13, Appendix C, Table 5 specifically calls out Unified Audit Logs in the Cloud Azure log category.
Remediation action
Section titled “Remediation action”To create one or more custom audit retention policies, if the default retention policy is not sufficient for agency needs, follow Create an audit log retention policy instructions. Ensure the duration selected in the retention policies is at least one year, in accordance with OMB M-21-31.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: soulemike; contributors: thomas-s-schmidt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.