A law firm wants to limit log retention to the minimum required by law and regulation. Which of the following is the engineer most likely to do FIRST?

A 2GB external hard drive is not a scalable or policy-driven log management solution and does not address retention requirements.

Configuring all systems in scope to log activities in support of company policies is the necessary first step because retention policies can only be responsibly applied once logging is confirmed to be comprehensive and aligned with legal and regulatory requirements. Without this baseline, limiting retention could inadvertently destroy records that law mandates be kept.

Configuring rotation limits before verifying that required logging is in place risks purging legally mandated records before their minimum retention period expires.

Deduplication, compression, and encryption are archiving operations that come after logging infrastructure and retention policy are established, not before.