TechKnowSurge
NIST 800-53 MP-6 ISC2 CISSP 2.4 CompTIA Security+ 4.2 NIST CSF ID.AM-08 ISC2 CISSP 2.5 NIST 800-53 SI-12 CompTIA Security+ 5.4 ISC2 CISSP 1.4
TechKnowSurge Catalog Videos Data Retention and Retirement
VideoSecurityFree

Data Retention and Retirement

Data retirement covers the processes and compliance requirements for properly archiving, sanitizing, or destroying data once it reaches the end of its life cycle. Understanding retention obligations, storage locations, and secure deletion methods is essential for managing data as both an asset and a liability.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

When data is no longer actively needed, it transitions from an asset to a liability, and organizations are responsible for retiring it in a controlled, compliant manner. The appropriate approach depends on the laws and regulations in effect, the sensitivity of the data, and internal business requirements. Personally identifiable information belonging to former customers, for example, must be removed from all systems to prevent future breach exposure — but identifying every location where that data lives, including primary databases, backup copies, and remote failover sites, is a prerequisite to any disposal action. Archiving and deletion serve distinct purposes in this process. An archive is not simply another backup; it is a deliberate move of data to lower-cost, less accessible storage for records that are unlikely to be needed again but cannot yet be permanently destroyed. This approach also improves the performance and efficiency of active systems by reducing database size and backup scope. When permanent deletion is required, simply removing a file is insufficient, because storage systems retain data in clusters until those sectors are overwritten. True sanitization requires either multi-pass overwriting with ones and zeros or physical destruction of the media through shredding or certified disposal services. Complicating disposal decisions are mandatory retention requirements, which vary by industry and data type. Financial records, for instance, must be kept for defined periods to satisfy audit and regulatory demands, while educational institutions are often required to retain student records for up to a decade. Managing data retirement effectively therefore depends on maintaining a current data inventory that classifies each data type and maps it to the correct retention period, archival strategy, or destruction method.

What you'll learn

What's covered

Data Retirement

Aligned to

NIST 800-53
MP-6 Media Sanitization
SI-12 Information Management and Retention
ISC2 CISSP
2.4 Manage data lifecycle
2.5 Ensure appropriate asset retention
1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context
CompTIA Security+
4.2 Explain the security implications of proper hardware, software, and data asset management
5.4 Summarize elements of effective security compliance
NIST CSF
ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles.

Key terms

Data Retirement
The process of managing data that has reached the end of its lifecycle, including decisions about archiving, deletion, or destruction.
Archive
A long-term storage location for data that is no longer actively used but may need to be accessed occasionally, typically on cheaper, less accessible storage.
Data Sanitization
The process of permanently and securely removing or destroying data from a storage device before disposal or reuse.
Data Retention
The practice of storing data for a required period of time to meet legal, regulatory, or business obligations before secure disposal.
Personally Identifiable Information
PII
Personally Identifiable Information is any data that can be used alone or in combination to identify, contact, or locate an individual, requiring protection under privacy laws and organizational security policies.
Physical Drive Destruction
A data sanitization method that permanently destroys storage media through shredding or similar physical means to prevent data recovery.

Topics

Data Retention Data Sanitization Data Lifecycle Management Regulatory Compliance Data Destruction Information Security

Transcript

When data reaches the end of its life cycle, that is, it's ready to be retired, then there are certain ways that we may need to handle that data, depending on what the laws and regulations and the company needs are.

When data reaches the end of its life cycle, it's time to retire it, and maybe we need to do some sort of archiving or destroying of this data, so we need to do that in a proper way. Data has that balance between being an asset and a liability, and when it's no longer an asset, then it's strictly a liability, and what we need to do is properly dispose of it. Of course, much of how we dispose of something is going to depend on the laws and regulations that you have to comply with.

Finding everywhere the data lives

So in this scenario, let's say that we have several users that are no longer customers. We have personally identifiable information. At this point, what we need to do is make sure they're no longer in our systems. It would be devastating if they have left us as a customer and then we have to notify them later on that we lost their data, and that we have to make it right with these users that are really no longer using our services.

But if only it were that simple, because data resides in a lot of different places. For instance, we may have a database where that information is at, and perhaps we have a backup copy of that as well, and maybe we have another site that has that same information in case we need to fail over to that site, with a backup copy there. So what we need to do is think about all of the different locations that this data could exist.

Archives versus backups

Archives are kind of similar to backups, but they serve a little different purpose. A backup is when we just take a data set and we create a copy of it and we keep it backup just in case something goes right and we need to do a restore of that. An archive is more of like when we're done with data and we don't need it anymore, but we may need to access it in a rare occasion, and so we are going to put it in a location that's not quite as accessible. Maybe it's a cheaper storage, but we don't have a lot of great access to it, and so we move it to that cheaper storage, that we are probably maybe not going to use this data again, but maybe potentially use that data again, and so then we put it into an archive.

Let me give you an example of this. Let's say we have a database here and it has a million records to it, and what we want to do is we want to delete 100,000 of those records, so we're going to kind of clean things up. But before we delete these 100,000 records, what we're going to do is we're going to move a copy of them into archive, so we have these old records that are in archive just in case we need them again. Then what we'll do is remove them from our system, so now we only have 900,000, which is great because now we've increased the performance of this database system. We're only backing up 900,000 records, and so now we have some of the advantages of keeping those records off of our system, but we still have an archive copy of it in case we need to access them again.

Sanitization

Now, just because you delete the data off of these different sources doesn't mean that the data still doesn't exist on them. What I mean by that is the way that a lot of storage works is it creates a copy of the file into something called clusters, and then it references these clusters for each of the files. So you could delete the file, and what it does is it just deletes the reference, but the data still exists until it gets written over.

So what we need to make sure is that the data actually gets deleted and completely removed. We call it sanitization, and we either do it by doing wipes, special wipes on the system writing ones and zeros multiple times, or we somehow physically do a destruction of the drives that it's on, so we do something like shred them, or send it to somebody who will properly dispose of those drives.

Retention requirements

Now, before we just start deleting certain data, we do need to keep in mind that some data we have to retain for a certain period of time. For instance, financial records we have to retain for a certain period of time. What that looks like is we may need to create an archive just in case we get audited, or some sort of the IRS comes in and wants to take a look at our records. Then what we need to do is make sure that we have some sort of data retention for certain data.

Another example might be that a lot of times when we don't have users, we are supposed to remove them from the system, but one of the exceptions to that is like schools have to maintain certain records for students for 10 years. So that's an example where they have a retention requirement.

Ultimately what we're going to have to do is do some sort of data inventory on what type of data we have, and then determine for each of those types of data how we're going to destroy that information or retain that information.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →