Requirement:

The asset owner shall have policies and procedures related to writing IACS security-related events to one or more protected event/audit logs and retaining them for an adequate time period.

Guidance: