Organizations should establish policy for how long evidence from an incident should be retained. Most
organizations choose to retain all evidence for months or years after the incident ends. The following
factors should be considered during the policy creation: