From an information security perspective, information that no longer supports the main purpose of the business should be:

Question

Options

• Aassessed by a business impact analysis.
• Bprotected under the information classification policy.
• Canalyzed under the data ownership policy.
• Danalyzed under the retention policy

• A
  9% (5)
• B
  4% (2)
• C
  16% (9)
• D
  71% (39)

Explanation

Option D is correct because a retention policy governs how long information is kept and what happens when it no longer serves a business purpose - including whether it should be archived or securely destroyed. When data outlives its usefulness, the retention policy is the mechanism that determines its fate, reducing storage costs, legal exposure, and security risk.

• A is wrong because a Business Impact Analysis (BIA) evaluates the criticality of systems/data to business continuity - it's used during disaster recovery planning, not end-of-life data decisions.
• B is wrong because the information classification policy defines how data should be labeled and handled based on sensitivity - it applies while data is in active use, not when determining whether to keep or dispose of it.
• C is wrong because a data ownership policy establishes who is responsible for data - ownership doesn't change just because data is no longer needed, and this policy doesn't govern disposal.

Memory tip: Think of "retention" as the data's "shelf life" label - when the expiration date passes and the data no longer supports the business, the retention policy is what you check to decide whether to keep it longer or toss it.

No community discussion yet for this question.