How far back does a NERC CIP audit look, and how long must evidence be kept?
If you have received a Regional Entity audit notice, the first question is how far back the auditors can look. The audit period starts the day after the end date of your previous Compliance Audit, and you must show compliance for the entire period. Most CIP standards require you to keep evidence of each requirement for three calendar years, but that retention window is not the same as the audit period. Where a standard's retention period is shorter than the time since your last audit, the Compliance Enforcement Authority expects you to demonstrate compliance for those gaps by other means, so the retention rule alone does not settle what you must produce.
The answer varies by standard, by log type and by when your last audit ended. CIP-002-5.1a and CIP-003-9, for example, both carry three-year retention for each requirement, while CIP-007-6 Part 4.3 requires retaining the Part 4.1 logs, where technically feasible, for at least the last 90 consecutive calendar days, and CIP-006-6 Part 1.9 sets a ninety-day minimum for physical access logs. Your organization owns its evidence and its retention schedule. The Regional Entity decides which items it samples and how far back it asks. Confirm your last Compliance Audit end date, then map every in-scope requirement to its retention period and to the audit period, and list the gaps before the notice arrives. The NERC Rules of Procedure Appendix 4C describes how monitoring and the audit period are applied.
There is no CIP certificate. The Regional Entity monitors compliance and issues findings, and an implementation partner such as DeployOpen can prepare systems, configuration monitoring, log retention and evidence folders so that your records match the audit period. It cannot issue audit findings or attest to compliance. Prepare by asking your team and any partner three questions: which logs were already rotated out of retention, which requirements depend on evidence that exists only for part of the period, and who on your staff can explain each record and its approval. Document any shortfall you find, since a clear account of how you covered a gap is easier to defend than an unexplained one.
Which retention rule applies to which evidence
Most CIP standards ask the entity to keep evidence of each requirement for three calendar years. CIP-003-9 and CIP-002-5.1a are useful examples. Under CIP-002-5.1a, the evidence for each requirement, including R1 (the High Violation Risk Factor requirement for categorization), must be kept for three calendar years. Under CIP-003-9, the same three-year period applies to the policy and plan evidence, including review records showing review within 15 calendar months and documented CIP Senior Manager approval.
- Policies and plans: Keep the current and prior versions, revision history or document management workflow records, and approvals for the retention period.
- Categorization records: Keep the CIP-002 lists and impact rating support that were in force during each year of the period.
- Review cycles: Keep proof that reviews happened on schedule, not only the final document.
- Rolling retention: Evidence rolls off as it ages, so the oldest year in the audit period may already be gone unless you have kept it.
- Version check: Confirm the retention wording in the current version of each standard, since the text is set per standard and per version.
Before an audit, confirm the three-year window for each requirement against the audit period in your notification letter.
The general rule does not end when the three years end if you have an open issue. Under the retention language used in CIP-003-9, information about any noncompliance must be kept until mitigation is complete and approved, if that is longer than the standard retention period. This matters most for entities with open Mitigation Plans, Compliance Exceptions or self-reported violations that are still being worked.
- Open items: Keep the violation record, root cause analysis, and the evidence of the fix until the Regional Entity approves completion.
- Closed items: Once mitigation is approved, the three-year clock for that evidence applies from the normal date.
- Linked evidence: Keep the configuration, log and access records that show the problem and the remediation.
- Tracking: Use a register that shows the open date, the mitigation milestones and the approval date for each item.
- Check the standard: Confirm the exact wording in the version under which the issue arose, because the retention statement is part of each standard.
Ask your Regional Entity to confirm in writing which records it expects you to keep for any open item.
CIP-007-6 Part 4.3 sets a shorter retention period for the security event logs in Part 4.1. Where technically feasible, the entity must retain those logs for at least the last 90 consecutive calendar days, unless CIP Exceptional Circumstances apply. The 90-day window is a minimum for the logs themselves, so it does not replace the three-year rule for the records that show the logging program works.
- Log set: Retain the Part 4.1 logs for at least 90 consecutive calendar days, measured from the most recent entry.
- Technical feasibility: If a device cannot keep logs that long, document why and what you did instead.
- Review records: Keep the evidence that logs were reviewed, which falls under the three-year rule.
- Exceptional circumstances: Record any event that you claim as an exception, with dates and approvals.
- Gap risk: An audit period longer than 90 days means logs from earlier in the period must come from a retained source, such as a central log store.
For each in-scope device, confirm where the logs are kept and for how long, and whether a central store is in place.
CIP-006-6 Part 1.8 requires logging the entry of each individual with authorized unescorted physical access into each Physical Security Perimeter. Part 1.9 requires keeping those logs for at least ninety calendar days. Because the requirement is about entry, the logs are the primary evidence for Part 1.8, and the access records that authorize each person are supporting evidence under other requirements.
- Entry logs: Keep the entry logs from badge, visitor or manual entry systems for at least ninety calendar days.
- Source systems: Confirm whether the logs live in the Physical Access Control System, a separate badge server or a log store, and whether each one keeps the full window.
- Authorization records: Keep the list of individuals with authorized unescorted access under CIP-004-7 for the three-year period.
- Visitor records: Keep visitor logs under the visitor control program, which should match the Physical Security Perimeter entries.
- Backups: Confirm that exported or archived logs are readable and complete, since a backup that is not tested may not support an audit request.
Set the ninety-day window in your PACS and log store, then test a retrieval for a date near the start of your audit period.
CIP-010-4 R2 requires monitoring of configuration changes for the applicable baseline items. The measures for R2 list evidence such as logs from a system that monitors configuration and records of the investigation of detected unauthorized changes. These logs are the core evidence for R2, and their retention depends on the three-year rule in the standard and the short log windows used elsewhere in your program, so confirm the exact period in the current version before you set a log store schedule.
- Monitoring logs: Keep the output of the configuration monitoring system for the retention period stated in the standard.
- Investigation records: Keep the tickets and notes that show each detected unauthorized change was reviewed and resolved.
- Baselines: Keep the baseline configuration records that the monitoring output compares against, including past versions.
- Change tickets: Link each approved change to the baseline update that followed it.
- Coverage gaps: Document any asset that the monitoring tool does not reach, and the compensating method used.
Before you rely on a monitoring platform for evidence, confirm with the vendor and your own records that it can export the full retention window for every in-scope asset.
What to do when retention is shorter than the audit period
Most CIP evidence must be kept for three calendar years, but some logs are kept for only 90 days, so a multi-year audit period can outrun what you still hold. The cards below cover how to close that gap: alternative evidence, archiving, documented decisions and early agreement with the Regional Entity.
Recognize the 90-day log gap
A 90-day log window shows what happened in the last quarter, not across the whole audit period. Where a standard's retention is shorter than the period under review, the entity must still show compliance for the full period. Map every requirement with a short retention window (for example, the 90-day log retention in CIP-007-6 Part 4.3 and the 90-day access log retention in CIP-006-6 Part 1.9) and list the period each one cannot cover on its own. Confirm which requirements are affected before the notification letter arrives.
Use periodic review records
Periodic review records, such as signed access reviews, configuration reviews and log review summaries, can show that a control operated throughout a period even when the underlying raw logs have rolled off. Each record should name the reviewer, the date, the systems covered and the result, and should be kept for the full three-year window. Ask the Regional Entity whether these records are acceptable for the requirement at issue before relying on them.
Keep investigation and incident records
Records of investigated alerts, detected unauthorized changes and resolved events show that monitoring worked during periods when raw logs no longer exist. CIP-010-4 R2 measures, for example, cite records of investigation of detected unauthorized changes as evidence. Store the ticket, the analyst's findings and the closure approval in the same repository so the chain from detection to resolution can be followed without the original log.
Archive exports before rolling deletion
Rolling deletion removes evidence on a fixed schedule, so retention decisions must happen before the window closes. Export the relevant logs, configuration snapshots and reports to a separate, access-controlled store on a set cadence, and record the export job, its hash or checksum and the storage location. Any archive that holds BES Cyber System Information must also meet CIP-011-3 protection requirements. Test restoring a sample export before you rely on it.
Document the retention decision
Write down which evidence is kept, for how long, where, and why it satisfies the requirement when the native retention is shorter. The record should name the requirement, the alternative evidence, the owner and the review date, and it should be approved by the CIP Senior Manager or a delegate. A written decision lets you explain the approach to an auditor quickly and shows that the choice was deliberate rather than an accident of storage settings.
Raise feasibility and agree alternatives early
Raise any question about whether a requirement can be met with a given log source or retention period with the Regional Entity well before fieldwork. Confirm in writing which alternative evidence is acceptable for each requirement, and file the answer with your audit records. Any mismatch found during the audit is harder to resolve than one raised during preparation, and the written confirmation is what you will show the audit team.
Which evidence holds up for a full audit period
The evidence that holds up in a CIP audit is evidence that shows the control worked on every day of the audit period, not just on the day the auditor asks. Start with policy documents. For CIP-003-9, the Medium Violation Risk Factor R1 measure expects policy documents, a revision history or a document management workflow record showing review within 15 calendar months, and documented approval by the CIP Senior Manager. Keep the approval record with the version it covers, so an auditor can match each review date to the policy text in force at that time. A policy that was reviewed on schedule but never re-approved after a change is a common gap.
For configuration change control, the evidence named in CIP-010-4 R2 measures includes logs from a system that monitors configuration and records showing that detected unauthorized changes were investigated. Export those logs with their collection settings and the monitoring interval in effect, and keep the investigation tickets that link each alert to a disposition. The same discipline applies to retained access and patch records. Confirm with your compliance lead how each standard's retention period interacts with the audit period, because some logs are kept for far shorter windows than three calendar years, and the Regional Entity may ask how you covered the gap.
Evidence must cover the whole audit period, so any control that changed during that period needs proof of both the old and the new state. Illustrative example: a monitoring tool is replaced in month 14 of a 36-month period. The team needs the old tool's configuration baseline and alert history through the cutover, the new tool's baseline and first records, and a change record showing who approved the switch and when. Without those pieces, the auditor sees a gap rather than a continuous control. Before fieldwork, map each in-scope requirement to its evidence sources across the whole period and mark every change point.
How to plan retention before the audit notice arrives
This sequence matches each CIP requirement's evidence to a retention period and a source system, so the registered entity can see gaps and choose alternative evidence well before the audit period is set. The output is a retention plan that the compliance team can defend to the Regional Entity.
Inventory requirements and their retention periods
The compliance lead lists every CIP requirement that applies to the entity's BES Cyber Systems, based on the CIP-002 categorization, and records the retention period stated in each standard's measures section. Most CIP standards call for three calendar years of evidence for each requirement, while some log requirements set shorter periods, so each entry should show its own period rather than a single assumed one. The output is a requirement register with a retention column that someone other than the author can check against the standard PDF.
Map each requirement to its evidence systems
For each register entry, the control owner names the systems, tools and records that generate the evidence, such as configuration monitoring tools, access logs, ticketing systems, training platforms and document management workflows. Owners also note where each record is stored and who can export it. The check that closes this step is a map in which every requirement points to at least one named source and one named owner, with any gaps flagged for follow-up.
Confirm the expected audit period start date
The compliance lead confirms with the Regional Entity or NERC contact what date the audit period would begin, which is the day after the end date of the previous Compliance Audit. Where the entity cannot find the previous audit's closing record, it asks the Regional Entity in writing for the reference. The output is a dated memo in the compliance file that states the start date and the source that confirmed it.
Compare each source's retention against the audit period
The compliance lead sets each evidence source's retention beside the audit period and marks any source that cannot hold evidence back to the start date. Logs with shorter retention periods, such as the 90-day window for certain CIP-007-6 logs and the 90-day window for CIP-006-6 physical access logs, will usually fall short, so they are marked first. The output is a comparison table showing for each source whether retention covers the full period, with each shortfall listed by requirement.
Export and archive short-retention records on schedule
Owners of sources with shorter retention set a recurring export schedule that copies records into a controlled archive with integrity protection and restricted access. Each export records the date, the source, the time range covered and the person who ran it, and CIP-011 information protection rules apply if the records contain BES Cyber System Information. The check that closes this step is an archive index that shows continuous coverage of the audit period for every short-retention source, with any missing ranges explained.
Record gaps and the alternative evidence chosen
Where a source cannot cover the whole audit period, the compliance lead documents the gap, the requirement affected and the alternative evidence the entity will offer instead, such as periodic review records, signed attestations or summary reports produced by the monitoring system. The Compliance Monitoring and Enforcement Program expects the entity to show compliance across the full period using other means where a standard's retention is shorter, so each alternative must be specific enough to be tested. The output is a gap register with an owner and a supporting record for every entry.
Confirm the approach with the compliance contact
The compliance lead shares the retention plan, the gap register and the proposed alternative evidence with the Regional Entity compliance contact and asks them to confirm that the approach is acceptable or to identify additional evidence they expect. Responses are filed with the plan and any changes are reflected in the register. The plan is complete when the entity holds written confirmation or a documented list of required changes, and when each change has an owner and a date set by the entity.
Who owns retention, who prepares evidence and who audits it
The registered entity owns its CIP program, including the retention periods it sets, the evidence it keeps and the answers it gives an auditor. Retention is not something a vendor or consultant can decide for the entity. The entity must know which standards require three calendar years, which require shorter periods such as the 90 consecutive calendar days for certain logs, and where its own records fall short of the audit period. The entity remains accountable for whatever its evidence shows, whether or not it engaged outside help.
- Retention decisions: Set and document the retention period for each requirement, and record why any period is shorter than the audit period.
- Evidence ownership: Hold the original records, including logs, approvals, revision histories and investigation notes, under the entity's own control.
- Audit period tracking: Confirm the start date of the audit period from the end date of the previous Compliance Audit.
- Responses to the auditor: Submit answers and evidence through the channels the Regional Entity specifies.
- Gap decisions: Decide how to address evidence gaps, including whether to self-report noncompliance.
Check that every retention rule in scope has a named owner and a documented exception process before the notification letter arrives.
An implementation partner such as DeployOpen prepares the systems and evidence that the entity uses. Work may include configuring log export, archive storage and retention settings, assembling evidence packs by requirement, and documenting how each record was produced. The partner works inside the entity's infrastructure and under its direction. The partner does not decide whether evidence is sufficient and does not issue findings, attestations or compliance statements. Those judgments belong to the Compliance Enforcement Authority.
- Log export and archiving: Configure retention and archive workflows so that logs from in-scope systems survive for the required period.
- Evidence packs: Organize records by requirement, date and asset so the entity can respond to requests quickly.
- Gap analysis: Compare the entity's current retention settings against the audit period and report shortfalls to the entity.
- Documentation: Record configuration baselines and procedures that explain how evidence is generated.
- Scope limits: The partner does not sign off on compliance, speak for the entity to the auditor without authorization, or replace the auditor's review.
Confirm in the written scope exactly which systems, archives and evidence packs the partner will prepare, and who holds the final copies.
The Compliance Enforcement Authority, which is a Regional Entity or NERC, monitors compliance and sets the audit period for a Compliance Audit. It requests evidence, samples records and judges whether the evidence shows compliance across the whole audit period. Where a standard's retention period is shorter than the audit period, the authority expects the entity to use other means to show compliance for the gap. The authority alone decides whether a finding is made and what follows from it.
- Audit period: The period starts the day after the end date of the previous Compliance Audit.
- Evidence requests: Requests are issued through the Evidence Request Tool according to the schedule in the notification letter.
- Sufficiency judgment: The authority decides whether the evidence is adequate for each requirement.
- Audit cadence: Registered entities that are Balancing Authorities, Reliability Coordinators or Transmission Operators receive a Compliance Audit at least once every three years, and other entities are audited on a risk-based schedule.
- Independence: Neither the entity's consultants nor the implementation partner can issue a finding in place of the authority.
Identify the Regional Entity for your registration and read its notification letter as soon as it arrives.
Retention mistakes that cause findings or extra requests
Most retention findings do not come from missing controls. They come from assumptions about how far back an audit reaches, how long logs really survive, and whether evidence shows the state of a system over time. Each card below names one error, why it matters for the audit period, and the check to run before the audit notice arrives.
Assuming the audit period is three years
Teams often count back three calendar years from today and stop there. The audit period actually starts the day after the end date of the previous Compliance Audit, so the window can be longer or shorter than three years depending on when the last audit closed. Pull the prior audit end date from your compliance records and confirm the start date with your Regional Entity before you gather anything. Then check that evidence exists for every day in that window, not only for the most recent years.
Letting log platforms delete 90-day logs
Many SIEM and log platforms apply rolling deletion or tiered storage that removes data before the retention window closes. Part 4.3 of CIP-007-6 requires retaining the Part 4.1 logs, where technically feasible, for at least the last 90 consecutive calendar days. A log tier set to 30 days, or an archive job that fails silently, can leave a gap that an assessor will find. Set the retention policy in the platform to match the requirement, alert on failed exports, and test a restore of a 90-day window before the audit.
Losing policy revision history
A current policy document shows what the entity intends, but auditors also test whether the policy was reviewed on time and approved by the right person. For CIP-003-9, evidence includes revision history or document management workflow records showing review within 15 calendar months, plus documented CIP Senior Manager approval. Overwriting a shared file or deleting old versions erases that trail. Keep every approved version in a controlled repository with timestamps, approvers and change notes.
Undocumented retention exceptions
Some systems cannot keep evidence for the full period, and some teams delete records under a local cleanup rule without telling anyone. When retention is shorter than the audit period, the entity must show compliance for the whole period using other means. Record each exception in writing, name the compensating evidence, such as exported snapshots or signed attestations, and store the exception record itself with the retained evidence. An undocumented gap looks like a violation even when the entity was compliant.
Showing only the current system state
A screenshot of today's configuration, patch level or access list proves the state at one moment. CIP audits test whether the requirement was met across the audit period, so snapshots alone rarely satisfy a sampled date. Pair point-in-time records with change logs, baseline comparisons, ticket histories and records of how detected unauthorized changes were investigated. Configuration monitoring output and its investigation records, as described in the CIP-010-4 measures, show this continuity more clearly than a single export.
Questions buyers ask about CIP audit periods and retention
How is the start of a NERC CIP audit period determined?
The audit period starts the day after the end date of the previous Compliance Audit. The Compliance Enforcement Authority expects the entity to show compliance for that entire period, not only for recent months. Where a standard's own retention period is shorter than the audit period, the entity must use other means to demonstrate compliance across the gap. The practical driver is the end date of your last audit, which your Regional Entity records, so confirm that date before you plan evidence collection. If you have never been audited, ask your Regional Entity how it sets the first period. The NERC Rules of Procedure Appendix 4C sets the general rule.
Does three-year evidence retention always apply to CIP standards?
No. Most CIP standards require keeping evidence of each requirement for three calendar years, but the retention period is set standard by standard and can differ. CIP-002-5.1a and CIP-003-9 both use the three-year rule, and information about any noncompliance must be kept until mitigation is complete and approved, which can run longer. Some requirements specify much shorter periods for specific records, such as logs. Read the measures and retention section of each standard that applies to your systems rather than assuming one period for all of them. Your compliance team should build a retention schedule that lists each requirement, its period and its owner.
What happens when security logs are kept for only 90 days?
A 90-day log window can be compliant for the requirement that sets it, but it does not cover an audit period that runs longer. For example, CIP-007-6 Part 4.3 requires retaining the Part 4.1 logs, where technically feasible, for at least the last 90 consecutive calendar days, except under CIP Exceptional Circumstances. Because the audit period can be longer than 90 days, you must show compliance for the rest of the period by other means, such as periodic reviews, retained summaries or records of investigations. Check whether the logs are retained where technically feasible, and document any system where that is not possible. Ask your log platform vendor to confirm how it handles retention and export before you commit to a design.
Can our own staff prepare CIP evidence without an outside firm?
Yes, a registered entity can prepare its own evidence, and the organization always owns its controls and its compliance responsibility. The work that tends to take time is building a retention schedule, mapping each requirement to the system that produces its evidence, and keeping records from the start of the audit period. An implementation partner such as DeployOpen can prepare self-hosted systems, logging and evidence collection inside your own infrastructure, but it does not issue audit reports or determine compliance. Only the Regional Entity, acting as the Compliance Enforcement Authority, decides the audit outcome. Decide early which parts your team will handle and which need outside support.
How much effort does CIP evidence retention need from internal staff?
The effort depends on how many requirements apply to your systems, how many systems are in scope, and how well evidence is generated automatically. Staff time usually goes into four areas: confirming the audit period start, deciding retention per requirement, collecting and labeling records from several tools, and reviewing gaps against the shortest retention period in use. Organizations with many in-scope systems and manual evidence processes usually need more time than those with centralized logging and document management. No figure is given here. Ask any provider for a written estimate that lists the systems, requirements and evidence sources it assumes, and ask your own team to inventory where records currently live.
Can a consultant guarantee the outcome of a CIP audit?
No. No consultant or implementation partner can guarantee a CIP audit outcome, because the Regional Entity or NERC decides what is compliant. A credible provider can prepare systems, document controls and organize evidence against the requirements, and can explain what the auditor will likely request. Be cautious of any offer that promises a clean result. Ask for a written scope that names the standards, systems, evidence and deliverables, and confirm that the provider does not issue audit reports or attestations.
What should a retention gap review check first?
A retention gap review starts by comparing each requirement's retention period with the full audit period. Where a period is shorter, the review should identify what evidence would show compliance across the gap, such as periodic exports, review records or investigation logs, and confirm whether that evidence exists. Next, it checks whether technical limits, such as storage constraints, justify an exception, and whether that limit is documented. Finally, it confirms the audit period start date with the Regional Entity. Note that the audit period start and the retention schedule are separate facts, so record both in writing.
How DeployOpen prepares retention and evidence for a CIP audit
DeployOpen's part starts with a written scope agreed before any work begins. For a CIP audit period question, that scope names the in-scope standards and Applicable Systems, the evidence types each requirement needs, and the retention rules that apply to each. Work is fixed-scope, and a quote follows from that written scope, so the engagement is priced against defined deliverables rather than open hours. The client owns its controls, its CIP Senior Manager decisions and every compliance position it takes with the Compliance Enforcement Authority. DeployOpen does not issue audit reports, attestations or findings. Independent auditors and the Regional Entity make those determinations.
Within the client's own infrastructure, DeployOpen configures log export and archiving so that evidence survives the period it must cover. The practical work is to set retention on each source to match the longest applicable rule: three calendar years for most standards, and at least 90 consecutive calendar days for the CIP-007-6 Part 4.1 logs where technically feasible, and the CIP-006-6 Part 1.9 physical access logs. Where a source cannot keep data that long, DeployOpen documents the retention gap, identifies the alternative evidence the client may rely on, such as exported snapshots, ticket records or periodic reports, and presents that analysis for the client to review. The client decides whether that alternative is acceptable for its program.
The engagement closes with an evidence pack and supporting records that the client keeps and reviews. The pack maps each in-scope requirement to its evidence, the location and retention period of each item, and the open gaps with their documented alternatives. Before any Regional Entity request arrives, the client should confirm with its own compliance lead and independent advisers that every audit period start date, which begins the day after the previous Compliance Audit ends, is covered. Any question about how a specific Regional Entity will treat an alternative source belongs with that Regional Entity or with the client's counsel, not with DeployOpen.
