A bank informs an administrator that changes must be made to backups for long-term reporting purposes. Which of the following is the most important change the administrator should make to satisfy these requirements?

The key phrase in the scenario is "long-term reporting purposes," which is a direct reference to data retention requirements. In highly regulated industries like banking, there are legal and compliance mandates (e.g., SOX, FINRA, Basel II/III) that specify the minimum duration for which financial records and related data must be stored. Therefore, adjusting the backup retention policy to ensure data is kept for the required number of years is the most critical change to meet these long-term obligations for auditing and reporting.

A. Location of the backups: This primarily addresses disaster recovery (geographic redundancy) and data sovereignty regulations, not the duration of data storage.
B. Type of the backups: This (full, incremental, differential) affects restore time and storage space consumption, but does not define how long the backups are preserved.
D. Schedule of the backups: This determines the frequency of backups and the Recovery Point Objective (RPO), not the length of time the data is kept available.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Reference: Section 4.3.2

"Backup and Storage

" page 4-11.

Quote/Paraphrase: The document states

"The backup strategy should also identify the retention periods for all backups." This establishes retention as a fundamental component of a compliant backup strategy

directly addressing how long data must be kept.

2. AWS Backup Developer Guide

Managing backups using backup plans.

Reference: Section on "Backup rule settings."

Quote/Paraphrase: The documentation specifies that a backup rule must include a lifecycle policy. This policy defines "when a recovery point is transitioned to cold storage and when it expires." The expiration setting is the direct implementation of a retention period

which is essential for long-term archival and compliance.

3. ISO/IEC 27001:2022

Information security

cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A

Control 8.10 "Information backup."

Quote/Paraphrase: This international standard for information security management specifies that a backup policy should be defined and implemented. The guidance for this control explicitly includes the need to define "retention requirements" for backups

underscoring its importance for governance and compliance.