SAO suggested to retain evidence for at least ____ years.

• A. 1 Year
• B. 5 Years
• C. 2 Years
• D. 10 Years

Answer: (C)

Evidence retention is about keeping material long enough to cover potential legal needs after an incident. The SAO guidance sets a minimum retention period to ensure evidence remains available for reviews, retesting, or any post-incident actions such as appeals or civil inquiries. Two years is the standard minimum because it provides a reasonable window for these possibilities without tying up storage indefinitely. After two years, some items may still be kept longer if the policy calls for it in certain cases, but the stated minimum is two years. One year is typically too short to cover many post-incident processes, while longer periods like five or ten years are beyond the minimum requirement.