A law firm wants to limit log retention to the minimum required by law and regulation. Which of the following is the engineer most likely to do FIRST?

Creating a small, external hard drive is an insecure, non-scalable, and inadequate logging solution for a law firm, and it does not define the necessary log content for compliance.

Before an organization can limit log retention, it must first define *what* information needs to be logged to meet legal and regulatory requirements. Configuring all in-scope systems to capture these specific activities according to company policies provides the foundational data set that will then be subject to retention guidelines.

Configuring daily log rotation on workstations addresses log volume and disk space, but it does not establish *what* logs are needed for compliance or provide a centralized, auditable log management strategy.

Deduplicating, compressing, and encrypting logs are optimization and security measures applied *after* logs have been collected and identified for archiving, not the initial step in defining retention requirements.