Section 3(3)(l) in The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018
(l)plan, develop, maintain and review the process of taking regular backup of logs of networking devices, perimeter devices, communication devices, servers, systems and services supporting "Protected System" and the logs shall be handled as per the Information Security Management System(ISMS) as suggested in clause (b).