A company receives a subpoena for email that is four years old. Which of the following should the company consult to determine if it can provide the email in question?

The data retention policy specifies how long each category of data - including email - must be retained, which is the governing document for whether the organization has a legal and procedural obligation to keep those records. Consulting this policy first establishes whether the email should exist before investigating the technical backup or archive systems.

A business continuity plan addresses how operations are maintained during disruptions and has no bearing on whether historical email records were retained under a legal or regulatory obligation.

Backup and archive processes describe the technical mechanisms for data storage but do not define retention periods or legal obligations - those are established by policy, not by the storage process itself.

An electronic inventory catalogs hardware and software assets and contains no information about email retention obligations or the availability of historical message data.