Security wants incident logs kept long enough for investigations yet not retained forever without justification. Which policy approach fits?
Select an answer to reveal the explanation.
Short Explanation
Keep the incident logs long enough to finish the investigation—and not forever just because disk is cheap. A retention policy is the grown-up middle path between shredding everything tomorrow and hoarding forever with no reason.
Full Explanation
Investigative and operational logs for municipal incidents must live under a deliberate data retention policy. Keep records long enough to support investigations, legal holds, after-action reviews, and regulatory obligations—but do not retain everything forever without a business or legal rationale that justifies cost, privacy exposure, and discovery burden. The policy sets retention periods by record type, disposal methods, and exceptions such as litigation holds, then operations enforce those periods consistently. Deleting all incident logs after twenty-four hours regardless of investigation needs destroys evidence before cases mature. Retaining every log forever with no legal or business rationale creates unnecessary privacy and e-discovery risk. Ignoring retention and letting each analyst keep personal USB copies fragments custody, invites loss or leak, and bypasses official repositories. Exam caveat: retention questions seek the balanced policy answer—neither purge-too-soon nor keep-forever without justification. Operational check: map incident log types to retention schedules, enforce automated disposal with legal-hold overrides, prohibit shadow USB archives, and verify a sample investigation still has required logs available through the official store.