cisagov / cyhy-system

Cyber Hygiene system and overall documentation/issue tracking
Creative Commons Zero v1.0 Universal
6 stars 0 forks source link

Develop a data retention policy for reports and artifacts #5

Open hillaryj opened 4 years ago

hillaryj commented 4 years ago

Develop a data retention policy so we can auto-delete reports/artifacts after a certain amount of time to prevent the disk from filling.

Motivation

Occasionally, the CyHy reporting disk partition runs out of space. When it runs out of space during a reports generation process, this causes errors and manual work to intervene and rerun the process.

Acceptance criteria

climber-girl commented 3 years ago

@hillaryj - I'm thinking keep the past 4 weeks' reports just in case we need to dig the reports out for some reason (e.g. cyhy_reports mailbox gets full and it takes people a couple weeks to realize they need a specific report). What do you think? If sounds good to you, I can run by Rick/Jason and anyone else who may need to be checked in with prior to officially documenting/implementing that change.

hillaryj commented 3 years ago

That sounds reasonable - data retention policies are often either specified either via number of days or number of artifacts.

Who would know who needs to sign off on the policy before implementation? Where should the policy live?

hillaryj commented 3 years ago

@climber-girl emailed up the chain and received buy-in from Rick Lichtenfels that:

  1. 30 days retention is enough
  2. Documentation via FAQ is a good place for now