CISM · Question #234
An organization decided to move its email to a Software as a Service (SaaS) model. Which of the following would pose the GREATEST security concern?
The correct answer is B. Retention policies. Email retention is a significant legal and compliance obligation - organizations must retain messages for specific periods (e.g., for eDiscovery, regulatory audits, litigation holds) and must also ensure timely deletion when required (e.g., GDPR right to erasure). When email…
Question
An organization decided to move its email to a Software as a Service (SaaS) model. Which of the following would pose the GREATEST security concern?
Options
- AScalability
- BRetention policies
- CStorage capacity
- DRecovery capabilities
How the community answered
(25 responses)- A8% (2)
- B76% (19)
- C4% (1)
- D12% (3)
Explanation
Email retention is a significant legal and compliance obligation - organizations must retain messages for specific periods (e.g., for eDiscovery, regulatory audits, litigation holds) and must also ensure timely deletion when required (e.g., GDPR right to erasure). When email moves to a SaaS provider, the organization may lose direct control over retention enforcement, legal hold capabilities, and deletion guarantees. Misconfigured or provider-imposed retention settings can result in regulatory violations or inability to respond to legal requests. Scalability and storage capacity are typically strengths of SaaS, not concerns. Recovery capabilities are usually better in enterprise SaaS than on-premises. Retention policy compliance is the most legally and operationally sensitive issue.
Topics
Community Discussion
No community discussion yet for this question.