Data Retention
Information and data should be kept only for as long as it is required, no more, and no less. For various types of data, certain industry standards, laws and regulations define retention periods, when such external requirements are not set, it is the organization's responsibility to define its own data retention policy and implement it.
4 slides · 1 min read · Domain 2
Data retention policies are applicable both for hard copies as well as soft copies, and they should not be kept beyond their required or useful life. Security practitioners should ensure that data destruction is being performed when an asset has reached its retention limit.
For the security professional to succeed in this assignment, an accurate inventory must be maintained, including the asset location, retention period requirement and destruction requirements. A periodic review of retained records is necessary to reduce the volume of information stored and ensure that only relevant information is preserved.
Record retention policies are used to indicate how long an organization must maintain information and assets.
Ensure the following:
- The organization understands the retention requirements for different types of data throughout the organization.
- The organization documents in a record's schedule the retention requirements for each type of information.
- The systems, processes, and individuals of the organization retain information in accordance with the schedule but not longer.
A common mistake in records retention is finding the longest retention period and applying it without analysis to all types of information in an organization.
Olog
This not only wastes storage but also increases risk of exposure and adds considerable "noise" when searching or processing information in search of relevant records.
Records and information no longer mandated to be retained should be destroyed in accordance with the policies of the enterprise and any appropriate legal requirements that may need to be considered.