In order for a company to boost profits by implementing cost savings on non-core business activities, the IT manager has sought approval for the corporate email system to be hosted in the cloud. The…

Creation and secure destruction address only the first and last stages of the lifecycle, omitting critical intermediate states such as data in transit and data at rest.

Information classification, vendor selection, and the RFP process describe procurement and vendor management activities, not the stages of the data lifecycle itself.

Data provisioning, processing, in transit, at rest, and de-provisioning represents the full end-to-end data lifecycle framework recognized in cloud security standards. This option ensures compliance obligations are addressed at every phase - from when data is created and processed, to how it is secured during transmission and storage, to how it is properly destroyed at end of life. No other choice covers all these states.

Securing virtual environments and appliances describes infrastructure security controls rather than the data lifecycle phases a compliance officer must track end-to-end.