CISSP Practice Question (Domain 2: Asset Security)

A business unit requests permanent retention of all customer transaction records "in case we ever need them." Legal has not issued a hold, and the current retention schedule requires deletion after seven years. As the data owner's advisor, what is the BEST response?

A. Honor the request since longer retention reduces legal discovery risk

B. Enforce the existing retention schedule and require a formal exception with risk acceptance

C. Migrate the records to cold storage to balance cost and accessibility

D. Defer to Legal before taking any action on the records

Come back for the answer tomorrow, or study more now!

12 comments