For how long are you required to keep an audit trail of changes in your IT environment?
Some compliance regulations require specific data retention policies. In my experience and from a little research we have a few time frames to look at.
For example:
HIPAA: Healthcare organizations generally need to retain records for at least six years from the date of creation or the date they were last in effect.
SOX: Public companies must retain audit and review records for five years from the end of the fiscal period in which the audit or review was concluded.
PCI: Organizations under PCI DSS should retain logs for at least one year
CCPA: Organizations must retain records of consumer requests for at least 24 months