Business Security Log Retention Requirements: How Long to Keep Logs How long must a small business keep security logs? HIPAA, PCI DSS, Virginia insurance law and the FTC Safeguards Rule, plus a simple hot and cold retention plan. Alden October 21, 2026