Question

A financial services firm is decommissioning several storage arrays that held customer account records subject to retention regulations. The records have exceeded their mandatory retention period and are no longer needed. The IT operations team plans to reformat the drives before sending the equipment to a third-party recycler. As the risk practitioner reviewing the data lifecycle disposal stage, what is your PRIMARY concern with this plan?

Accepted Answer

Reformatting does not guarantee irrecoverable destruction of the data, so a sanitization method appropriate to the media and data sensitivity should be applied and verified

Answer

The recycler should be selected based on the lowest cost to minimize the expense of decommissioning

Answer

The equipment should be retained on-site indefinitely in case the records are needed for future business analytics

Answer

The retention period should be extended to ensure the firm never has to make a disposal decision