Retention of Business Records

The information security manager should ensure that an adequate record retention policy is in place and that this is followed throughout the organization. A record retention policy will specify what types of data and documents are required to be preserved, and what must be destroyed. It also specifies the number of years for which that data is required to be preserved.

Figure 1.5: Record retention

Record retention should primarily be based on the following two factors:

• Business requirements
• Legal requirements

If a record is required to be maintained for three years as per the business requirements, and for two years from a legal perspective, then it should be maintained for three years.

Organizations generally design their record retention policy in line with the relevant laws and regulations.

Electronic Discovery

Electronic discovery (e-discovery) is the process of the identification, collection, and submission of electronic records in a lawsuit or investigation. The best way to ensure the availability of electronic records is to implement comprehensive retention policies. A retention policy dictates the terms for storing, backing up, and accessing the records.

Key Aspects from the CISM Exam Perspective

The following are some key aspects from the exam perspective:

Question	Possible Answer
What is e-discovery?	E-discovery is the process of identifying, collecting, and submitting electronic records in a lawsuit or investigation.
What are the factors on which record retention is based?	Business requirements. Legal requirements. (If both options are available, then preference should be given to business requirements as it is generally assumed that business requirements already include consideration of legal requirements.)

Figure 1.6: Key aspects from the CISM exam perspective

Practice Question Set 4

1. Which of the following has the most influence while planning business record retention?
   1. Potential changes in storage capacity
   2. Potential changes in regulatory requirements
   3. Potential changes in business strategy
   4. Potential changes in application systems and media
2. Which of the following is the most important consideration in business record retention?
   1. Strategic objectives
   2. Regulatory and legal requirements
   3. Storage capacity
   4. Level of control implemented
3. Due to changes in the business strategy, certain information now no longer supports the purpose of the business. What should be done with this information?
   1. It should be analyzed under the retention policy
   2. It should have restricted access
   3. It should be frequently backed up
   4. It should be evaluated by a business impact analysis
4. As an information security manager, you have been asked to design a strategy to minimize the impact of an e-discovery in the event of litigation. What is the most effective method to achieve this?
   1. Keeping backups of sensitive data
   2. Limiting access to sensitive data
   3. Not storing sensitive data
   4. Implementing comprehensive retention policies