A company needs to keep the fewest records possible, meet compliance needs, and ensure destruction of records that are no longer needed. Which of the following best describes the policy that meets…

Question

Options

• ASecurity policy
• BClassification policy
• CRetention policy
• DAccess control policy

• A
  4% (2)
• B
  2% (1)
• C
  88% (46)
• D
  6% (3)

Explanation

A Retention Policy (C) directly governs how long records must be kept, when they must be destroyed, and ensures the organization holds only what is legally or operationally required - matching all three requirements in the question (minimizing records, meeting compliance, and mandating destruction).

• A (Security Policy) is wrong because it defines how to protect information (access controls, encryption, etc.), not how long to keep it.
• B (Classification Policy) is wrong because it categorizes data by sensitivity level (e.g., public, confidential) but doesn't dictate retention duration or destruction.
• D (Access Control Policy) is wrong because it controls who can access records, not how long records exist or when they're destroyed.

Memory tip: Think of the word "retain" - a Retention Policy answers the question "How long do we keep this?" Whenever an exam question mentions record lifecycles, destruction schedules, or minimizing stored data, that's your signal to pick Retention Policy.

No community discussion yet for this question.