How long should records relating to security be retained onboard?

The CISR requires records to be retained onboard for three years. This is to ensure that all records that have been made since the last verification are available at the next verification.