What is a decent system that will not break the bank as far as retaining system audit logs and reporting? I am sure there are other requirement like the veracity of the logging and evidence collection process that is also part of basic 3.3