Data Retention & Disposition Policy
Second Front's data retention policy for production information stored on cloud infrastructure managed for the platform.
Data retention defines what data to store and how long to store it. This data is commonly used for disaster recovery, network forensics, network analytics, and cybersecurity investigations. Proper data retention standards reduce the company's attack surface and prevent the accumulation of unnecessary data and the resulting costs.
This policy letter establishes the data retention policy for all production information stored on cloud infrastructure owned or operated by Second Front (2F). The scope of this policy includes all AWS regions and any other providers that host infrastructure managed by 2F for the 2F Platform as a Service (PaaS).
1 - Data categorization & retention periods
The data categorization and retention periods define data categories and specify how long to retain each one. Security, operational, and compliance requirements determine retention periods.
Retention period: 1 year
Audit scope includes:
- Successful and unsuccessful login attempts
- Privileged or system-level activity
- Session start and end times
- Concurrent logins from different workstations
- Access to protected objects or resources
- Program initiations and direct system access
- Account creation, modification, disabling, and termination
- Kernel module loads, unloads, and restarts
Backup requirement:
- Back up audit records to a separate system from the source at least once a week.
Retention period: 1 year
Audit scope includes:
- Successful and unsuccessful login attempts
- Privileged or system-level activity
- Session start and end times
- Concurrent logins from different workstations
- Access to protected objects or resources
- Program initiations and direct system access
- Account creation, modification, disabling, and termination
- Kernel module loads, unloads, and restarts
Backup requirement:
- Back up audit records to a separate system from the source at least once a week.
Retention period: 1 year
Includes:
- All inbound and outbound network traffic
- All internal traffic within the environment
Retention period: 3 months
Includes:
- Backups and snapshots of systems, applications, and data that are critical to organizational survival
2 - Superseding procedures
Retention periods explicitly stated in local network or system operating procedures may supersede this document if they extend the retention timelines defined above. This policy establishes the baseline for retaining data in cloud environments.
3 - Superseded policies
This policy supersedes the Second Front (2F) Data Retention Policy dated August 20 2021.
4 - Reference documents
This section lists the authoritative documents and government directives that inform this policy.
| Publication | Title | Date |
|---|---|---|
| Directive-type Memorandum (DTM) 22-001 | DOW Standards for Records Management Capabilities in Programs Including Information Technology | June 02 2023 |
| DoDD 5400.07 | DOW Freedom of Information Act (FOIA) Program | April 05 2019 |
| DOW Instruction 5015.02 | DOW Records Management Program | February 24 2015 |
| NARA Pubs | National Archives and Records Administration General Records Schedule | Latest |