Which of the following documentation should be referenced FIRST when deciding how long to retain backup data?

An offsite storage contract specifies terms with a third-party vendor but does not define the organization's internal data retention requirements.

Standards compliance refers to external standards like ISO or PCI-DSS, which provide guidelines but are often interpreted and implemented through corporate compliance policies.

Industry best practices offer general recommendations but are not legally binding or specific to an organization's unique regulatory and business needs.

Corporate compliance documentation, which includes legal, regulatory, and internal business policies, establishes the mandatory minimum and maximum retention periods for data, making it the definitive first reference for backup data retention.