So let's start from requirement 3.1,
and 3.1 is really easy; it's just like if you don't need it,
don't keep it, yeah?
Right, and well, if you do need it, so if you don't need it,
don't keep it, that's the easy way, right?
The hard way is if you do need it, then figure out for how long you need it,
right, and you may have different categories for you know,
this case merits this retention period and that case
merits some other retention period, and so that could get complex very quickly,
right?
And then when you get to the end of that retention period,
have some meaningful way of disposing of those records.
Right.
So as an assessor you're looking for retention policy?
I am.
Right, and then you're looking for how that retention policy is implemented?
Right.
And is that okay if it's oh,
Fred goes into database every few weeks and does it manually?
So the manual process can be done.
I'd say you want some assurance that it's working the way you expect so
that somebody maybe is auditing whatever Fred is doing,
to say, okay, every couple weeks,
which should be somewhat defined as opposed to whenever Fred remembers,
right?
It's going,
looking at data and saying which of these records have hit their
retention period and then is he catching them all,
right?
And then is that sort of satisfactory for all of the different storage types?
Now, I'd say this is relatively easy in a database,
right, where you can go make queries and drop rows or what have you.
I'd say if you've got maybe recordings of cardholder data,
from a contact center or something like that,
like the spoken numbers that are recorded,
which is for a variety of reasons,
kind of a snake pit of compliance difficulties.
You know,
then maybe that's more troublesome because those call
recordings won't necessarily identify themselves as this one
has card data and this one doesn't.
So that can get messy very quickly.
Very quickly.
I'm actually going to stay away from call recordings.
Okay, let's do that.
We can actually run a whole course on how to do
contact-sensitive call recordings.
Right, and the easy way involves a chemical accelerant and a fire,
and the hard way is much, much harder.
The easy way is actually using analog tape because it's
not digital and PCI doesn't apply.
You could do that.
But no one has analog tapes anymore.
Yeah, where does one go to acquire analog such a thing?