Which of the following constitutes the essential elements of a data retention policy for OT logs and analytics data?

Which of the following constitutes the essential elements of a data retention policy for OT logs and analytics data?

• A. Delete all data after 24 hours.
• B. Retain all data indefinitely without access controls.
• C. Archive data manually without automation.
• D. Define retention periods by data type, ensure legal/compliance requirements, secure storage, regulate access, and implement automated archival and deletion.

Answer: (D)

The key idea is that a data retention policy for OT logs and analytics must establish structured, enforceable rules that specify how long different data types are kept, where they are stored securely, who can access them, and how automated processes handle archival and deletion. Retention periods should be defined by data type to reflect how long each kind of data is actually needed for operations, security monitoring, incident response, and regulatory compliance. Legal and regulatory requirements may dictate minimum or maximum retention; the policy should align with those obligations. Secure storage means applying appropriate protections—encryption, tamper-evidence, and physical security—as well as proper access controls so only authorized personnel can view or modify the data. Regulating access ensures data is not exposed beyond those who need it, reducing risk. Automated archival and deletion ensures the policy is implemented consistently, scalably, and with auditable trails, avoiding reliance on manual steps that are error-prone or forgotten. The other options fall short because they implement extreme or incomplete approaches: deleting everything after a short window ignores forensic, regulatory, and operational needs; retaining everything indefinitely with no access controls creates enormous risk and compliance gaps; and archiving manually without automation is unsustainable at scale and prone to inconsistency.

The key idea is that a data retention policy for OT logs and analytics must establish structured, enforceable rules that specify how long different data types are kept, where they are stored securely, who can access them, and how automated processes handle archival and deletion. Retention periods should be defined by data type to reflect how long each kind of data is actually needed for operations, security monitoring, incident response, and regulatory compliance. Legal and regulatory requirements may dictate minimum or maximum retention; the policy should align with those obligations. Secure storage means applying appropriate protections—encryption, tamper-evidence, and physical security—as well as proper access controls so only authorized personnel can view or modify the data. Regulating access ensures data is not exposed beyond those who need it, reducing risk. Automated archival and deletion ensures the policy is implemented consistently, scalably, and with auditable trails, avoiding reliance on manual steps that are error-prone or forgotten.

The other options fall short because they implement extreme or incomplete approaches: deleting everything after a short window ignores forensic, regulatory, and operational needs; retaining everything indefinitely with no access controls creates enormous risk and compliance gaps; and archiving manually without automation is unsustainable at scale and prone to inconsistency.