Record retention
The information security manager should ensure that an adequate record retention policy is in place and that this is followed throughout the organization. A record retention policy will specify what types of data and documents are required to be preserved, and what should be destroyed. It will also specify the number of years for which that data is required to be preserved.
Record retention should primarily be based on the following two factors:
- Business requirements
- Legal requirements
If a record is required to be maintained for 2 years as per the business requirements, and for 3 years from a legal perspective, then it should be maintained for 3 years. Organizations generally design their business requirement after considering the relevant laws and regulations.
Electronic discovery
Electronic discovery (e-discovery) is the process of the identification, collection, and submission of electronic records in a lawsuit or investigation....
