Logging, Backups and Evidence Retention Minimums

When something goes wrong on a yacht network, the first question is often simple: what happened?

That question becomes difficult very quickly. The firewall log may have overwritten itself. The vendor VPN record may sit in a supplier portal nobody can access. The CCTV export may be gone. The backup job may show green but nobody has tested restore. The cloud sign-in record may be available, but only to a management-company admin who is not answering the phone.

Logs, backups and evidence retention are what turn a confusing technical event into a reconstructable timeline.

Logging and backup practices are not only technical hygiene. They support cyber incident response, supplier accountability, insurance claims, privacy assessment, operational continuity and sometimes incident investigation. A firewall log, VPN login, CCTV export, cloud admin record or backup snapshot may be the only evidence showing when a problem started.

Start with the systems that create the best evidence:

• Firewall and WAN edge logs.
• VPN and remote-access logs.
• Wi-Fi controller logs.
• Core switch and network-controller events.
• Server and NAS authentication logs.
• Cloud admin and sign-in logs.
• Email security alerts.
• Endpoint protection alerts.
• Backup success and failure logs.
• CCTV/NVR access and export logs.
• Access-control admin logs.
• SatCom portal/admin logs.
• OT support workstation logs where available.

The goal is not to collect every possible event. The goal is to keep enough evidence to answer who connected, from where, to what, when, and what changed.

On smaller yachts, this may be a simple managed firewall portal, cloud audit log, backup report and support ticket record. On larger yachts, it may include central syslog, SIEM, managed detection, endpoint telemetry and formal evidence retention. Scale the system to the yacht, but do not leave the yacht blind.

Useful logs should include timestamp, username, source IP or device, target system, event type, success or failure, admin action and system response. Time synchronization matters. If firewalls, servers and cloud systems use different time settings, incident timelines become messy.

Every yacht should use a reliable time source for core infrastructure. For isolated OT environments, document how time is set and what limitations exist.

Retention should match consequence and privacy rules. Guest Wi-Fi connection logs may create privacy obligations. Firewall and VPN logs may be needed for incident response. CCTV access logs may support security investigations. OT event logs may help explain machinery or alarm behaviour.

A practical baseline is to keep operational security logs long enough to spot delayed discovery and support investigation, while restricting who can access them. Higher-risk systems need longer or better-protected evidence. Exact periods should be set by management policy, legal/privacy advice and system capability.

The key is intentionality. A yacht should know whether a log keeps seven days, thirty days, ninety days or longer. Accidental retention is weak governance. Accidental deletion is weak evidence.

Logs are weak evidence if an attacker or careless admin can delete them. Critical logs should be exported or forwarded where practical. For small yachts, this may be a managed firewall portal, cloud log retention, NAS syslog target or monitored IT support platform. For larger yachts, it may be a SIEM or managed detection service.

Access to logs should be limited. Crew should know how to preserve them, but not everyone should be able to delete them.

Backups should cover data and configuration. Data backups include documents, PMS records, crew files, accounting data, procurement records, planned maintenance, email exports and operational folders. Configuration backups include firewalls, switches, Wi-Fi controllers, NAS settings, server images, VPN configuration, AV/IT controller settings and critical cloud configurations.

For OT, preserve PLC/HMI project files, automation server backups, alarm lists, cause-and-effect records, remote-access settings and vendor software versions where the yacht is permitted to hold them.

For AV and guest systems, preserve controller configurations, matrix settings, DSP files, media server settings and network controller exports. Those systems may not be statutory, but they can consume huge support time if they must be rebuilt from memory during a guest trip.

The most useful backup record is not "backup completed." It is "restore tested." Keep records of file restores, system restores, configuration imports and recovery exercises. Note what was restored, who performed it, how long it took, what failed and what changed afterwards.

Management should be able to see restore evidence in plain terms: what was restored, when it was tested, how long it took, and what gap was found. The evidence should not require decoding a backup console screenshot.

After a suspected cyber incident:

• Do not wipe systems immediately.
• Record who found the issue and when.
• Capture screenshots where useful.
• Preserve firewall, VPN, endpoint, cloud and backup logs.
• Export affected account activity.
• Save suspicious emails with headers where possible.
• Record containment steps.
• Document any vendor remote access.
• Preserve affected devices if practical.

This does not mean delaying safety action. If a system threatens safe operation, protect the vessel first. But avoid destroying evidence unnecessarily.

For most yachts, a useful minimum pack includes:

• Current network diagram and critical-system list.
• Firewall, VPN and remote-access log retention settings.
• Cloud admin and sign-in log access route.
• Backup schedule and latest restore-test record.
• Configuration exports for firewalls, switches, Wi-Fi controllers and NAS.
• Vendor remote-access register.
• Incident evidence checklist.
• Contact list for IT provider, management, insurer, legal and key vendors.

Keep a copy available outside the systems most likely to fail.

• Logs overwrite after 24 hours.
• Backup software is monitored, but restore is never tested.
• Firewall configurations are not exported before changes.
• Vendor access logs are held only by the vendor.
• CCTV exports are overwritten before a security review.
• OT project files exist only on one engineer's laptop.