What is required for data retention policy when storing alarm customer data?

• A. Data should be stored on public servers for easy access.
• B. Secure, access-controlled storage with retention per policy; encryption if applicable.
• C. Data can be stored indefinitely without controls.
• D. Data should be stored only on local devices with no access control.

Answer: (B)

When storing alarm customer data, the essential rule is to keep it in a secure, access-controlled environment and only as long as the retention policy requires, with encryption used if feasible. This approach protects confidentiality and integrity, ensuring only authorized people can reach the data and that nothing is kept longer than necessary, reducing risk if a breach or loss occurs.

Storing data on public servers would expose it to broad, uncontrolled access, which contradicts the need for strict access controls. Keeping data indefinitely without a defined retention schedule ignores privacy and regulatory expectations and increases risk over time. Relying on local devices with no access controls creates vulnerability if a device is lost, stolen, or accessed by unauthorized individuals, and it lacks centralized policy enforcement.