CGEIT · Question #606
Which of the following BEST enables an enterprise to determine an appropriate retention policy for its information assets?
The correct answer is A. Business and compliance requirements. To establish an effective data retention policy, an enterprise must primarily consider its specific business needs and all applicable legal and regulatory compliance obligations.
Question
Which of the following BEST enables an enterprise to determine an appropriate retention policy for its information assets?
Options
- ABusiness and compliance requirements
- BBusiness storage and processing needs
- CBackup and restoration capabilities
- DExternal customer data retention requirements
How the community answered
(25 responses)- A96% (24)
- C4% (1)
Why each option
To establish an effective data retention policy, an enterprise must primarily consider its specific business needs and all applicable legal and regulatory compliance obligations.
Business and compliance requirements are paramount because they define how long data must be kept for operational needs and how long it *must* be kept to satisfy legal, regulatory, or contractual obligations (e.g., SOX, GDPR, HIPAA). These requirements dictate the minimum and often the maximum retention periods, forming the fundamental basis of any retention policy.
Business storage and processing needs influence the technical implementation and cost of retention but do not solely determine the policy itself.
Backup and restoration capabilities are mechanisms for implementing a retention policy, ensuring data availability and recoverability, but they do not dictate the retention periods.
External customer data retention requirements are a *subset* of compliance requirements and specific business needs, not the overarching factor for all information assets.
Concept tested: Data retention policy drivers
Topics
Community Discussion
No community discussion yet for this question.