A data breach has occurred at Company A and as a result, the Chief Information Officer (CIO) has
resigned. The CIO’s laptop, cell phone and PC were all wiped of data per company policy. A
month later, prosecutors in litigation with Company A suspect the CIO knew about the data breach
long before it was discovered and have issued a subpoena requesting all the CIO’s email from the
last 12 months. The corporate retention policy recommends keeping data for no longer than 90
days. Which of the following should occur?
A.
Restore the CIO’s email from an email server backup and provide the last 90 days from the
date of the subpoena request.
B.
Inform the litigators that the CIOs information has been deleted as per corporate policy.
C.
Restore the CIO’s email from an email server backup and provide the last 90 days from the
date of the CIO resignation.
D.
Restore the CIO’s email from an email server backup and provide whatever is available up to
the last 12 months from the subpoena date.