NIST 800-171 Audit Log Storage Sizing Calculator
Audit and accountability practices expect you to create, protect and retain system logs. The hard part is knowing how much storage that means. This calculator converts events per second into daily volume and retained storage.
Your numbers
Servers, firewalls, endpoints, identity systems, SaaS tenants and ERP servers in scope.
Windows security events and JSON logs are often 500 to 1,500 bytes; syslog lines are smaller.
Set by your policy and contract. SP 800-171 does not fix a number of days.
Blended cost of your storage tier.
Your results
Sizing estimate only. Measure real event rates for two weeks before buying storage, and confirm retention with your contract and counsel.
Total storage vs online retention days
Sweeps Online (searchable) retention from 30 to 365, holding your other inputs fixed.
Optional logging design review
We can review your log sources, retention and protection design for a CUI environment.
Optional. The tool and every export work without this. No spam.
How to use it
Count the sources that must log inside your CUI boundary, then estimate the average events per second per source from a sample week. Enter average event size, the period you keep logs searchable and your total retention period. The calculator splits storage into an online tier with index overhead and a compressed archive tier, then prices both at your blended per-GB rate.
- Use averages, then add headroom for peaks and incident spikes.
- Include identity, firewall, VPN and the ERP application servers.
- Add forwarders and collectors to your source count if they log too.
The formulas
Events per day equals sources times EPS times 86,400. Raw gigabytes per day equals events times bytes divided by one billion. Online storage equals daily volume times online days times the index factor. Archive storage equals daily volume times the days beyond the online window, divided by the compression ratio. Retention is a policy decision: SP 800-171 requires audit records but does not state a day count, while DFARS 252.204-7012 requires preserving relevant images and monitoring data for at least 90 days after a cyber incident report.
Common mistakes
Teams often size for steady state and forget that a noisy event such as a failed logon storm or verbose debug setting can multiply volume tenfold. Another mistake is storing logs on the systems being logged, which weakens protection of audit information. Log timestamps also need a synchronized time source, otherwise correlation after an incident is unreliable.
- Protect log storage with separate access control from the logged systems.
- Test restore from archive at least once a year.
Frequently Asked Questions
How long must I keep audit logs for CMMC Level 2?
NIST SP 800-171 requires audit records to be created and retained for monitoring and investigation but sets no fixed number of days. Your policy, contract clauses and any incident preservation duty decide the period.
What is the index factor?
Search platforms store extra index data beside raw events. A multiplier of about 1.2 to 2.0 covers that overhead depending on how much of the text is indexed. Check your platform vendor sizing guide.
Is one EPS per source realistic?
It varies widely. A quiet file server may emit a fraction of an event per second while a domain controller or firewall can emit hundreds. Sample real counts per source class and sum them.
Does this cover packet capture?
No. Full packet capture is far larger than event logs. If you retain it for incident response, size it separately from throughput and retention.
If you want to search logs and ERP audit trails in plain language without sending them to a public cloud, we build private retrieval over your own data. Talk to us about an on-prem pilot.
Related Tools
CMMC Level 2 Remediation Budget Calculator
Turn a gap count and CUI headcount into a first-year CMMC Level 2 budget, with a sweep showing how cost scales with the number of CUI users.
Aerospace & DefenseCUI Enclave vs Enterprise Scope Cost Calculator
Model whether a dedicated CUI enclave is cheaper than bringing every user into scope, with a break-even CUI headcount and a what-if chart.
Compliance & ContractsPlan of Action and Milestones (POA&M) Template
Fill in a security requirement gap and get a formatted POA&M document with weakness, risk, resources, milestones and sign-off lines.
Aerospace & DefenseDFARS Flowdown Subcontractor Risk Tracker
An editable worksheet that records CUI exposure, flowdown status and cyber maturity per subcontractor and scores risk so you know whom to chase first.
More Aerospace & Defense tools
See all- DPAS Rated Order Acceptance Deadline Calculator
- Export License Delay Schedule Risk Calculator
- CMMC 2.0 Level 2 Readiness Assessment
- ITAR Compliance Checklist for Manufacturers
- DFARS 252.204-7012 Compliance Self-Assessment
- AS9100 Audit Readiness Checklist
- Export Control Screening Checklist
- Defense Contractor AI Readiness Assessment
- Counterfeit Parts Risk Assessment (AS5553)
Keep exploring
Free tools
- NIST 800-171 POA&M WorksheetAn editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.
- NIST 800-171 SPRS Score CalculatorCalculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
- SAP Interface Volume and Storage Sizing WorksheetAn editable worksheet that turns messages per day, average size and retention into daily megabytes, peak hourly load and total storage.
ERP fixes and how-tos
- Costpoint Cloud or On-Prem for a Contractor Handling CUI?Deciding between Deltek Costpoint cloud and self-hosted for a defense contractor with CUI: scope, shared responsibility, cost, control, what to verify.
- ERP Data Archiving Strategy: What to Archive and What to PurgeHow to decide what ERP data to archive or purge: find the big tables, set retention by record type, keep reports and audits working, and test restores first.
- Error validating SYSPRO online profile: what it means and how to fix itWhy SYSPRO fails to validate an online profile, plus the usual storage and runtime error messages, and a clean order of checks to fix each one.
Guides
- On-Prem AI for CUI in Small ManufacturersOn-prem AI for CUI: how small defense manufacturers run an LLM on their own GPUs inside the NIST 800-171 boundary, with hardware sizing and real trade-offs.
- Controlled Unclassified Information in Your ERPWhere CUI hides in a manufacturing ERP: attachments, routings, BOMs, travelers and reports, plus how to scope, permission and audit it for NIST 800-171.
- Building a CUI Enclave for Defense ManufacturingHow to build a CUI enclave for defense manufacturing: scope NIST SP 800-171 and CMMC boundaries, isolate ERP and engineering data, and cut assessment cost.
AI on your ERP
- Mapping DFARS 7012 and NIST 800-171 Controls to AI on Your ERPMap DFARS 252.204-7012 and NIST SP 800-171 control families to an AI system layered on your ERP, with evidence a Compliance Manager can defend.
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
Manufacturing hubs
- Aerospace and Defense Subcontractors on Long Island, New YorkLong Island aerospace and defense subcontractors: machining, fabrication and electronics shops, anchors, AS9100, ITAR and CMMC needs, and ERP and quoting problems.
- MEP centers: the Manufacturing Extension Partnership National Network explainedWhat MEP centers are, what the NIST MEP National Network offers small manufacturers, how to find your state center, and how it fits with ERP and AI projects.