A new information security manager learns that the organization is preserving large amounts of customer data logs. Portions of the data are not required by law to be retained, and related storage…

The correct answer is C. Review the current data retention policy. The correct governance response is to review the current data retention policy before taking any action on the data itself. The policy will clarify what data must be kept, for how long, and for what business or legal purpose. Immediately destroying data (B) could violate…

Submitted by ngozi_ng· Apr 18, 2026Information Security Governance

Question

A new information security manager learns that the organization is preserving large amounts of customer data logs. Portions of the data are not required by law to be retained, and related storage costs are increasing. Which of the following is the BEST course of action to address this concern?

Options

ASecure the data with appropriate encryption.
BDestroy the data immediately.
CReview the current data retention policy.
DMaintain an off-site backup of the data.

How the community answered

(28 responses)

A
4% (1)
B
4% (1)
C
82% (23)
D
11% (3)

Explanation

The correct governance response is to review the current data retention policy before taking any action on the data itself. The policy will clarify what data must be kept, for how long, and for what business or legal purpose. Immediately destroying data (B) could violate existing policies or create legal exposure. Encrypting it (A) or creating off-site backups (D) would increase costs without solving the underlying retention problem. Updating the retention policy through proper channels ensures any data disposal is authorized and documented.

Topics

#Data Retention#Policy Review#Data Governance#Information Lifecycle Management

Community Discussion

No community discussion yet for this question.

Full CISM Practice