Following a data breach, legal counsel advises that litigation by affected customers is likely. Routine retention schedules will soon delete logs and emails related to the incident. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
When a lawsuit is on the horizon, you hit pause on the shredder. That's a legal hold, and it overrides your normal retention clock for anything relevant. Deleting now, even 'by policy', can look like destroying evidence.
Full Explanation
A legal hold, sometimes called a litigation hold, suspends normal retention and deletion for information that may be relevant to reasonably anticipated litigation. Once counsel indicates litigation is likely, the organization has a duty to preserve relevant data, and failing to do so can lead to sanctions and an inference that the destroyed information was unfavourable. The security manager supports counsel by identifying relevant systems, data owners and custodians, and by ensuring automated deletion is suspended for that scope. Continuing normal retention appears policy-compliant, but the duty to preserve overrides routine schedules for relevant data, and the policy itself should contain a legal hold exception. Deleting records to reduce discovery costs is exactly the conduct that creates spoliation risk and undermines the organization's legal position. Copying all corporate data to an external archive is excessive, costly and may create new privacy and security exposure; preservation should be scoped by counsel to relevant information. Exam caveat: legal hold decisions are made and scoped by legal counsel, while the security manager provides technical execution and verification. Operational check: confirm the hold notice lists custodians and systems, that deletion jobs are suspended for that scope and that compliance is periodically verified.