A recent benchmarking analysis has indicated an IT organization is retaining more data and spending significantly more on data retention than its competitors. Which of the following would BEST ensure

Requiring retention plans in business cases is a good practice for new data, but it does not address the existing excessive data retention identified by the benchmarking analysis.

Data retention policies are inherently tied to an organization's acceptable risk level, compliance requirements, and business value. By revalidating the risk tolerance, the organization can identify if its current retention policy is overly conservative, leading to unnecessary data storage and costs, allowing for a more precise, risk-based adjustment of the policy to retain data only for as long as truly necessary.

Moving backups to cloud storage might shift costs or improve efficiency for certain data tiers, but it does not fundamentally address why so much data is being retained in the first place, which is the root cause of the excessive spending.

While aligning with industry best practices can be a guide, 'best practices' might not perfectly fit a specific organization's unique risk profile, compliance obligations, or business needs, which are better captured by revalidating internal risk tolerance.