A global financial company is reviewing its data retention policies. The Chief Information Security Officer wants to ensure the organization is implementing retention periods that minimize both legal risk and storage costs. Which of the following approaches represents the BEST strategy for data retention policy development?
You selected this option
Retain data as long as needed to ensure availability for future business intelligence and legal discovery
You selected this option
Retain data for a seven-year period where necessary to simplify compliance management
You selected this option
Delete data promptly after transaction completion to minimize storage and security costs
You selected this option
Develop a data classification scheme with retention periods based on legal requirements, business needs, and industry regulations
The correct approach is to develop a data classification scheme with retention periods based on legal requirements, business needs, and industry regulations. This creates a tailored framework that properly categorizes data and applies appropriate retention periods to each category. This balanced approach minimizes both legal risk (by ensuring compliance with retention requirements) and storage costs (by not keeping unnecessary data longer than required).
The seven-year retention period ignores varying requirements across data types and jurisdictions. Deleting data promptly after transactions fails to meet record-keeping requirements and loses business intelligence value. Retaining data as long as needed is too vague and potentially violates data minimization principles in regulations like GDPR while increasing storage costs and complicating information governance.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a data classification scheme?
Open an interactive chat with Bash
Why are retention periods important for compliance?
Open an interactive chat with Bash
What are the implications of not following a data retention policy?
Open an interactive chat with Bash
ISC2 CISSP
Asset Security
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Oh snap!
Loading...
Loading...
Loading...
Information Technology Package Join Premium for Full Access