A court order has ruled that your company must surrender all the email sent and received by a certain employee for the past five years. After reviewing the backup systems, the IT administrator…

Tape backup policies govern the mechanics of how backups are performed and rotated, but the root problem is that no requirement existed to retain the email data long enough - a storage medium policy does not establish retention duration requirements.

Offsite backup policies address where backup media is stored for disaster recovery purposes but do not define how long any category of data must legally be preserved.

A data retention policy specifies the minimum and maximum periods for which different data types - including email - must be stored and in what format. If the organization has no policy requiring email to be kept for five years, it has no compliance mechanism to produce those records when legally required. Reviewing and updating the data retention policy to align with legal and regulatory requirements directly addresses this gap.

Data Loss Prevention policies focus on preventing unauthorized disclosure or exfiltration of sensitive data in transit or at rest; they do not govern archival duration or legal hold requirements.