Study. uk . com
  1. Home
  2. All questions
  3. Question 792

CISM study material · question 792 of 1000

Which two factors does NIST say the decision on evidence retention should weigh? Choose two.

  1. The preferences expressed by the affected system's own owner
  2. The physical storage space available on site
  3. What it costs to keep the data, plus the hardware and software needed to read it later
  4. The possibility of prosecution
Show the answer

Answer: D. The possibility of prosecution
C. What it costs to keep the data, plus the hardware and software needed to read it later

SP 800-61r3 ties retention to evidence preservation procedures and data retention policy, weighing whether prosecution may follow against what storage and future access will cost.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.AN-07.R1

Challenge yourself on this topic → Study as cards