After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold…

A legal hold (also known as a litigation hold) is a directive requiring a company to

preserve all forms of potentially relevant information when litigation is pending or

reasonably anticipated. The primary goal is to prevent the spoliation (destruction or

alteration) of evidence. Option B accurately describes this action: retaining "any

communications related to the security breach" ensures all potentially relevant

electronically stored information (ESI) and other data are preserved. The phrase "until

further notice" correctly reflects that the hold remains in effect until legal counsel

determines it can be lifted. This comprehensive approach is crucial for meeting legal

obligations during a lawsuit.

?

A. Retain the emails between the security team and affected customers for 30

days. This is incorrect because the "30 days" timeframe is arbitrary and likely

insufficient for a legal hold, which typically lasts much longer. The scope is also too

narrow, focusing only on specific emails.

C. Retain any communications between security members during the breach

response. This is too narrow. While communications between security members are

important, a legal hold encompasses all information relevant to the breach, not just

internal security team discussions.

D. Retain all emails from the company to affected customers for an indefinite

period of time. This is incorrect because it limits the scope to only "emails from the

company to affected customers," which is not comprehensive enough. While "indefinite

period" is closer to the correct duration, "until further notice" (as in option B) more

accurately reflects the procedural nature of lifting a legal hold.

Cornell Law School - Legal Information Institute (LII). "Legal Hold."

URL: https://www.law.cornell.edu/wex/legal_hold

Details: The definition states: "A legal hold is a process that an organization uses to

preserve all forms of potentially relevant information when litigation is pending or

reasonably anticipated... The hold orders the client not to delete, destroy, or otherwise

modify records (both paper and electronic) that may be relevant to the subject of a

lawsuit or investigation. The legal hold will stay in effect until the attorneys notify the

client that the hold is lifted." This supports the broad scope ("all forms of potentially

relevant information") and duration ("until the attorneys notify the client that the hold is

lifted," i.e., "until further notice").

NIST IR 7628 Rev. 1, "Guidelines for Smart Grid Cyber Security," Vol. 2. (April 2014)

URL: https://nvlpubs.nist.gov/nistpubs/ir/2014/NIST.IR.7628r1.pdf

Details: Page 138, Section 6.7.1.1 states: "Legal holds require that any business

records, including ESI, that may be relevant to the subject of the dispute be preserved

and protected from destruction or alteration." This supports the requirement to preserve

a broad range of records ("any business records, including ESI, that may be relevant").