TechKnowSurge

VideoSecurityFree

Backup Retention and Disposal

Backup data must be managed throughout its entire lifecycle, from defining how long it is retained to ensuring it is securely disposed of when no longer needed. Retention periods and disposal methods must align with compliance requirements and customer contractual obligations.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Backup data carries the same sensitivity as the original source, meaning that improper handling at any stage of its lifecycle can expose an organization to serious risk. Two critical aspects of backup management are retention and disposal: how long data is kept, and how it is permanently destroyed once it is no longer needed. Both must be governed by a clearly defined policy that accounts for legal and regulatory compliance as well as the specific terms agreed upon with customers. Retention requirements vary widely depending on the industry and the nature of the customer relationship. Some clients require years of archived data to remain accessible for potential restoration, while others — increasingly common in privacy-focused regulations — demand that their information be completely removed once a service contract ends. Organizations must be prepared to accommodate both extremes and ensure their backup strategies reflect these obligations without creating compliance gaps. Once data has reached the end of its defined retention period, secure disposal is not optional. Backup media must be destroyed in a way that makes the data irrecoverable, whether through certified third-party disposal services or physical destruction methods such as drilling or incineration depending on the media type. Failing to properly dispose of backup assets leaves sensitive data vulnerable and can result in regulatory penalties, reputational damage, or breach of customer trust.

What you'll learn

Explain the purpose of data retention periods and the compliance considerations that govern how long backup media must be kept
Describe proper disposal methods for backup media once retention periods have been met

What's covered

Backup Data Management

Data Security Risks
- Sensitive Data Exposure
- Wrong Hands Concern
Retention Periods
- How Long to Keep Data
- Long-Term Customer Needs
  - Up to 10 Years
- Compliance Requirements
- Customer Demands Vary
  - Remove After Service Ends
Disposal of Assets
- Reached Retention Period
- Disposal Methods
  - Professional Services
  - Physical Destruction

Key terms

Disaster Recovery: The process and procedures for recovering IT systems and data following a disruptive event.
Data Integrity: The assurance that data has not been altered or corrupted during storage or transmission.
Retention Period: The defined length of time that backup data is kept before it is deleted or disposed of.
Media Disposal: The secure destruction or sanitization of backup media once its retention period has been met, ensuring that sensitive data cannot be recovered by unauthorized parties.
Compliance: The act of adhering to the laws, regulations, standards, and internal policies that govern how an organization handles data and security. Compliance programs use audits and controls to demonstrate that requirements are being met.

Topics

Data Backup Backup Media Data Retention Secure Disposal Compliance Data Lifecycle Management

Transcript

There is data on top of this tape, and if it were ever to get into the wrong hands that could be detrimental, depending on what data that is. So we have to be conscious of that. There are some retention periods that we have to have for certain things, and then we also have to dispose of things correctly. So we need to think through that process of how we're going to treat that backup after we take it.

Retention periods

A retention period is just how long we need to, or are going to, keep something after we record it. After we take a backup of something, we need to decide how long we are going to retain that. Some customers I've encountered want you to retain things for a long time. If they come back, they want you to be able to restore something and give them their information back, whatever it is. In fact, some of my clients wanted something like 10 years of information, to be able to store that amount of information on backup or archive.

This is also problematic for other customers, because other customers don't want you to retain their information after they're no longer customers. And this is becoming more and more of a thing: once a customer ends your services, they require you to remove that information, especially in certain industries. So we need to understand what the repercussions from that are. We need to establish what our retention periods are, and make sure it follows any kind of compliance and also our customers' demands.

Disposal

Once we've reached the retention period, what we need to do is dispose of those assets, dispose of that information. As an example, once we're done with this media, it needs to be properly disposed of. There are services out there that will actually do that for you, or you can do it yourself with maybe a drill or, depending on the material, maybe fire, or whatever the case may be. But the point is that we need to make sure that once we're done with our backups, it's properly disposed of.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →