A data breach has occurred at Company A and as a result, the Chief Information Officer (CIO) has resigned.
The CIO’s laptop, cell phone and PC were all wiped of data per company policy. A month later, prosecutors in
litigation with Company A suspect the CIO knew about the data breach long before it was discovered and have
issued a subpoena requesting all the CIO’s email from the last 12 months. The corporate retention policy
recommends keeping data for no longer than 90 days. Which of the following should occur?

A.
Restore the CIO’s email from an email server backup and provide the last 90 days from the date of the
subpoena request.

B.
Inform the litigators that the CIOs information has been deleted as per corporate policy.

C.
Restore the CIO’s email from an email server backup and provide the last 90 days from the date of the CIO
resignation.

D.
Restore the CIO’s email from an email server backup and provi