3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Please answer as an IT staff for an equity firm:

Does the company create, protect, and retain information system audit records for between 30 days and 1 year (depending on data source and applicable regulations) to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity?

Are logs and log storage systems protected from unauthorized access and is access restricted to individuals with who need them for their job function?

Have requirements for content of audit records been defined and created?