# Ensure tenancy audit log retention period is 365 days or greater

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698520346569-ensure-tenancy-audit-log-retention-period-is-365-days-or-greater
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the OCI Audit service retains audit logs for at least 365 days. Audit logs record every API call made in the tenancy, including who made the change, when, and from where, and are needed for security investigations and compliance.

**Rationale**

Security incidents are often discovered weeks or months after they happen. If audit logs are deleted too soon, there may be no record of what an attacker did. Oracle now retains audit logs for 365 days in commercial tenancies, but the setting should still be verified, and logs needed for longer should be exported to Object Storage or a SIEM.

**Impact**

-   Audit history is available for a full year
    
-   Supports investigations and compliance audits
    
-   Longer retention requires exporting logs, which adds storage costs
    

**Default Value**

Oracle documentation states that audit logs are retained for 365 days and that this can't be changed in the Console. Older tenancies set through the API may show a value between 90 and 365 days.

**Pre-Requisites**

-   Tenancy administrator access
    
-   OCI CLI access if the value must be updated
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the Profile menu and select Tenancy (Tenancy details).
    
3.  Check the Audit retention period value.
    
4.  Alternatively, run: oci audit config get --compartment-id <tenancy-ocid> and check retentionPeriodDays.
    
5.  If the value is less than 365, follow the implementation steps.
    

**Implementation Steps**

1.  Open Cloud Shell or a terminal with the OCI CLI configured as a tenancy administrator.
    
2.  Run: oci audit config update --compartment-id <tenancy-ocid> --retention-period-days 365
    
3.  Run: oci audit config get --compartment-id <tenancy-ocid> and confirm the value is 365.
    
4.  If logs must be kept for more than 365 days, use Connector Hub to copy audit logs to an Object Storage bucket or a SIEM.
    

**Backout Plan**

1.  Run: oci audit config update --compartment-id <tenancy-ocid> --retention-period-days <previous-value>
    

**Reference**

-   [https://docs.oracle.com/iaas/Content/Audit/Tasks/settingretentionperiod.htm](https://docs.oracle.com/iaas/Content/Audit/Tasks/settingretentionperiod.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.