Enforce Data Retention
Description
Retain data according to the enterprise’s data management process. Data retention must include both minimum and maximum timelines.
Implementation Checklist
Tool Recommendations
Data governance and compliance platform with DLP, information protection, sensitivity labels, and insider risk management
Microsoft · Per-user subscription (E5/standalone)
Cloud-native DLP and CASB platform providing inline data protection for SaaS, IaaS, web, and endpoint
Netskope · Per-user subscription
Enterprise data loss prevention covering endpoint, network, storage, and cloud channels with policy-based content inspection
Broadcom · Enterprise license
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Stale Data Targeted in Breach
ConfidentialityData retained beyond its useful life provides attackers with a larger trove of sensitive information during a breach, including historical records that should have been purged.
Litigation Risk from Over-Retention
ConfidentialityData retained beyond legal hold or regulatory requirements becomes a liability, subject to discovery in legal proceedings where the organization would prefer the data had been disposed.
Vulnerabilities (When Safeguard Absent)
No Defined Data Retention Timelines
Without minimum and maximum retention periods, data accumulates indefinitely, expanding the attack surface and increasing regulatory exposure.
No Automated Enforcement of Retention Policies
Without enforced retention schedules, data deletion depends on individual judgment, leading to inconsistent practices and perpetual data hoarding.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |