After successfully recovering from a major breach, an incident response team lead is finalizing documentation. During the wrap-up meeting, a junior analyst asks how long the collected logs, disk images, and captured network traffic must be kept. According to NIST SP 800-61, which element of the incident response plan most directly governs this decision?