Certified Information Systems Security Professional (CISSP) — Question 104

Which of the following is the FIRST requirement a data owner should consider before implementing a data retention policy?

Answer options

• A. Storage
• B. Training
• C. Legal
• D. Business

Correct answer: C

Explanation

The correct answer is 'Legal' because before implementing any data retention policy, it is essential to understand the legal obligations regarding data storage and retention periods. The other options, while important, come after legal considerations in the policy-making process.