3.4: Enforce Data Retention
Control is new to this version of the control set.
Control Statement
Retain data according to the enterprise’s data management process. Data retention must include both minimum and maximum timelines.
[csf.tools Note: For more information on the Critical Security Controls, visit the Center for Internet Security.]