An organization’s data policy MUST include a data retention period which is based on

A.
application dismissal.

B.
business procedures.

C.
digital certificates expiration.

D.
regulatory compliance.