IoT Governance After Year One: Data Retention, Traceability and Audit Readiness
DBR77 Team · Published
After the first year, IoT governance comes down to four things: a named owner for every signal and definition, a retention rule for each type of data, a traceable link from machine events to batches and orders, and access rules an auditor can check. Set them up once and review them every quarter, and the system stays trustworthy as lines, people and regulations change.
Year one is about connecting machines and getting people to use the data. Year two brings harder questions: why OEE jumped when nothing changed on the floor, how long to keep vibration data, who approved a threshold. This article answers them for a mid-size plant.
Why governance becomes urgent in year two
Definitions drift, usually without anyone noticing. Someone corrects an ideal cycle time, a reason list grows from 12 entries to 60, a new line arrives with different naming. Each change makes sense on its own, but together they make last year's numbers incomparable with this year's.
Regulation is also moving. The amended Polish National Cybersecurity System Act, which implements NIS2, has been in force since 3 April 2026. It covers selected industrial activities, depending on sector and company size, with an adaptation period running to 3 April 2027. Under the NIS2 Directive, covered entities send an early warning within 24 hours of a significant incident and a notification within 72 hours. For AI, the 2026 "AI Omnibus" moved high-risk AI Act obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I, which includes AI as a safety component of machinery.
As our article on CMMI and data maturity argues, consistent data definitions come before serious use of AI.
Roles: who owns signals and definitions
Most plants need only three roles, each limiting who can change what:
- Signal owner. One person per signal group. Maintenance owns machine states, quality owns scrap and test results, production owns reason lists. The owner answers when a signal is missing or wrong.
- Definitions owner. One person, often in controlling, owns the formulas: OEE, planned time, ideal cycle time, response time.
- System owner. IT/OT owns access, backups, updates and the network.
Definitions change through a short, written process:
- Request with a reason, for example a new tool that changes the ideal cycle time.
- Impact check: which KPIs and reports move, and by how much.
- Approval by the definitions owner, with an effective date.
- Entry in the change log. History is never recalculated silently; if a recalculation is needed, it is flagged.
Data retention: what to keep and for how long
Data loses value at different rates: raw high-frequency signals are useful for weeks, while events and aggregates stay useful for years. The durations below are illustrative; your legal, customer and sector requirements set the real minimums.
| Data type | Keep how long (illustrative) | Why | Owner |
|---|---|---|---|
| Raw high-frequency signals (current, vibration) | 30 to 90 days on site, selected windows longer | Troubleshooting, training a model on known failures | Maintenance with IT/OT |
| Machine events (states, stops, reasons, alert response times) | 3 to 5 years | Loss trends, root-cause history, audits | Production |
| Aggregates (OEE per shift, downtime per reason per day) | Life of the line | Long-term comparison, business cases | Operations |
| Batch- and order-linked records | As your sector or customer requires | Traceability, complaints, recalls | Quality |
| Definition and configuration change log | Life of the system | Explaining why a number changed | Definitions owner |
| Access and security logs | Per your security policy, for example 12 months | Incident investigation, NIS2 reporting | IT/OT |
Camera-based events from the IRIS Vision layer belong with machine events. The layer has no video recording by design, so there is no footage to store, secure or delete.
Need a retention and ownership plan for your plant?
We go through your signals, systems and audit requirements with you and draft a one-page governance model.
Traceability: which records link to batches and orders
Traceability means you can rebuild a batch's history from the data. In food, it is a legal duty: Regulation (EC) No 178/2002 requires businesses to identify who supplied them and whom they supplied. Customers and auditors in other sectors ask for the same.
For each run, link these records to the batch or order number:
- start and end time on each machine;
- process parameters during the run;
- stops and reasons that occurred during the batch;
- quality checks, scrap and rework;
- material lots and the shift that ran it.
To test it, pick a batch from eight months ago and ask the quality manager to rebuild its history. If that takes longer than 15 minutes, the links above are incomplete.
Access and security after year one
DBR77 processes data on site at the edge, inside your IT/OT boundary, which keeps external data flows few and easy to document. Our article on edge vs cloud in manufacturing explains when each makes sense, and the security page describes the setup.
ISA/IEC 62443 frames security as a shared responsibility of asset owners, integrators and suppliers. NIST SP 800-82 Rev. 3 adds practical guidance for OT. In daily terms: operators enter reasons, supervisors assign tasks, only the definitions owner edits formulas, and vendor remote access is time-limited and logged.
Audit readiness checklist
An auditor will ask how you know your numbers are right. Have these ready:
- A signal register: every signal, its source machine and its owner.
- A definitions document with version history.
- Written retention rules, applied automatically.
- A passed batch reconstruction test from the last quarter.
- An access list reviewed in the last quarter, with leavers removed.
- An incident procedure that meets the 24-hour and 72-hour reporting steps where NIS2 applies.
- A list of AI models in use and the decisions they influence.
Governance rhythm: the quarterly review
The review takes about one hour per quarter. It covers data quality (unknown reasons, signal gaps), the change log, the access list, storage against retention rules and regulatory dates. Give each open audit finding an owner and a date.
This review is the top layer of the plant's rhythm, described in turning IoT into a repeatable operating system. With more than one plant, run it centrally for shared definitions, as explained in proving IoT value across sites.
FAQ
How long should we keep raw machine data?
Usually weeks, not years. Keep raw high-frequency data for 30 to 90 days, save windows around known failures, and keep events and aggregates far longer. Check sector and customer rules first.
Does NIS2 apply to our plant?
It depends on your sector and size. The Polish act covers selected industrial activities only, so ask legal counsel to confirm your status.
Who should own the OEE definition?
One person outside the line, often in controlling. Plants propose changes; the definitions owner approves them with a date and a log entry.
Do cameras create a privacy problem?
The IRIS Vision layer records no video by design. It keeps events such as a cycle or a stop, governed like any machine event.
Conclusion
A good first step is the batch reconstruction test from the traceability section, run on a batch from eight months ago. Whatever the quality manager cannot find within 15 minutes shows which owner, retention rule or link is missing, and those gaps make a concrete agenda for the first quarterly review.
Get your IoT setup audit-ready
Talk to us about owners, retention and traceability for your plant, and how DBR77 IIoT keeps data on site.
Sources
- KPMG Law Poland, Dyrektywa NIS2 wdrożona w Polsce. Nowe obowiązki cyberbezpieczeństwa dla przedsiębiorców, 2026
- EUR-Lex, Directive (EU) 2022/2555 (NIS2 Directive), 2022
- Future of Privacy Forum, The AI Act Implementation Timeline: What Changes Under the AI Omnibus?, 2026
- ISA, ISA/IEC 62443 series of standards
- NIST, SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security, 2023
- EUR-Lex, Regulation (EC) No 178/2002 (General Food Law), 2002
- DBR77, CMMI and data maturity