Is an organization's legal requirement to store certain data for a given timeframe the most important factor in log retention?

• A. True
• B. False
• C. Not applicable
• D. Depends on jurisdiction

Answer: (B)

Log retention is guided by a mix of inputs, not a single rule. Legal requirements tell you minimums and required data to preserve, but the most important factor is whether the retained logs actually support the organization's security, incident response, and forensics needs while also respecting privacy and storage costs. If you only follow the legal minimum, you may under-retain logs needed to detect and investigate incidents; if you retain too much, you risk privacy issues and wasted resources. The best approach balances regulatory obligations with threat-detection needs, data usefulness, and privacy considerations.