An IS auditor is reviewing the organization's data management practices for compliance with data retention policies. The auditor finds that while data is backed up regularly, the backup retention periods are not explicitly aligned with the organization's legal and regulatory data retention requirements. What is the MOST significant risk this poses?
- APotential for unauthorized access to historical data due to prolonged storage.
- BDegradation of backup media over time, making older data unrecoverable.
- CIncreased storage costs due to excessive backup retention.
- DInability to produce required data for legal or regulatory inquiries.
Show answer & explanationAnswer & explanation
Correct answer: D. Inability to produce required data for legal or regulatory inquiries.
Legal and regulatory data retention requirements dictate how long certain types of data must be kept. If backup retention periods are not explicitly aligned, the organization might unintentionally delete data required for audits, litigation, or regulatory compliance, leading to severe penalties, legal consequences, and reputational damage. This is a direct operational and legal failure.
Why the other options are wrong
- A. While prolonged storage can increase security risk, the immediate and most direct risk of misaligned retention policies is the inability to fulfill legal obligations.
- B. Media degradation is a technical risk related to backup health, not directly to the policy's alignment with legal requirements.
- C. Increased storage costs are a financial concern, but not as critical as legal non-compliance.
Data Retention Policy Compliance
Data Retention Policy Compliance ensures that data is stored for the legally and operationally required duration, balancing regulatory obligations, business needs, and data minimization principles.
- Driven by legal, regulatory, and business requirements.
- Affects backup schedules and archiving strategies.
- Non-compliance can lead to fines and legal issues.
Memory trick: Retention: 'R'eally 'E'nsure 'T'hat 'E'verything 'N'eeds 'T'o 'I'nclude 'O'bligations 'N'ow