A company needs to keep the fewest records possible, meet compliance needs, and ensure destruction of records that are no longer needed. Which of the following best describes the policy that meets these requirements?

A retention policy defines how long specific types of data or records must be kept and when they should be securely disposed of. This directly addresses the need to keep the fewest records possible, meet compliance requirements (which often dictate minimum retention periods), and ensure destruction of unneeded records. A security policy is too broad, covering overall security objectives and rules, but not specifically data lifecycle management. A classification policy categorizes data based on sensitivity, which is a prerequisite for a retention policy but doesn't define retention periods itself. An access control policy dictates who can access what resources, which is unrelated to how long data is stored.