An organizational policy specifying requirements for data retention, including what must be retained, where it will be stored and for how long, and the method of disposal.