Evidence of an attack is no longer present due to a scheduled data purge. What would be the appropriate recommendation?

The loss of critical evidence due to a data purge indicates a failure in the existing data retention policy. In any security incident investigation, preserving evidence is paramount for forensic analysis, understanding the attack's scope, and potential legal action. The most appropriate and responsible recommendation is to conduct a thorough review of the current policy. This re-evaluation should aim to extend retention periods for security-relevant data to ensure that evidence of future attacks is not prematurely or inadvertently destroyed.

A. Reporting the incident without sufficient evidence would be difficult and likely unproductive. The first step is to address the internal policy failure.

B. Ignoring the deletion of evidence is negligent and prevents the organization from learning from the incident or improving its security posture.

C. Maintaining a policy that has demonstrably failed to preserve critical evidence is illogical and leaves the organization vulnerable to the same issue in the future.

1. Proofpoint, Inc. (2021). Proofpoint Threat Response Getting Started Guide. While not explicitly stating this scenario, the guide's premise is based on the availability of forensic data for incident response. The entire function of Threat Response relies on data being retained long enough for analysis and remediation. (Chapter 1: Introduction to Threat Response).

2. NIST. (2012). Guide to Integrating Forensic Techniques into Incident Response (SP 800-86). National Institute of Standards and Technology. This foundational cybersecurity document emphasizes that "organizations should establish policies and procedures for data retention... to ensure that pertinent information is available for analysis." (Section 3.3.2, Data Retention).