An organization has a short-term agreement with a public Cloud Service Provider (CSP). Which of the following BEST protects sensitive data once the agreement expires and the assets are reused?

Continuous monitoring and analysis addresses ongoing threat detection but does not address data remnants on CSP storage after the agreement expires and assets are repurposed.

While internal encryption keys protect data confidentiality during the agreement, they do not ensure the actual destruction of data remnants on CSP storage once the contract ends and keys are revoked.

A contractual agreement legally obligates the CSP to wipe data from storage environments upon agreement termination, ensuring data sanitization before asset reuse. This is the most effective control because the organization does not have direct physical access to cloud infrastructure, making contractual enforcement the primary lever. This aligns with cloud data lifecycle management best practices, where data destruction clauses in Service Level Agreements (SLAs) or contracts are the standard mechanism for protecting residual data.

NIST guidelines for data wiping apply to media under the organization's direct control; the organization cannot physically apply wiping procedures to CSP-managed infrastructure, making this impractical in a cloud context.