An enterprise's information security function is making changes to its data retention and backup policies. Which of the following presents the GREATEST risk?

Not consulting business data owners presents the greatest risk because they are ultimately accountable for their data, understand its criticality, regulatory requirements, and business value, meaning changes without their input could lead to policies that are misaligned, non-compliant, or cause data unavailability.

Increased cost is a financial impact, but typically not the greatest risk compared to potential data loss or non-compliance due to incorrect policy.

Hosting backups at third-party locations introduces new risks (e.g., vendor management, security of third party) but these can be managed if data owners are consulted and risks assessed; the lack of consultation is a more fundamental problem.

An increased retention period for data backups generally reduces risk by making data available for longer, although it may increase cost or storage requirements.