How long should PMK records be retained?

• A. Retention duration per legal/regulatory requirements and policy
• B. Indefinitely
• C. One year
• D. Until the client discontinues engagement

Answer: (A)

The main idea is that how long records are kept should follow what laws, regulations, and your organization’s own policy require, not a fixed or arbitrary timeframe. Retaining PMK records for the period dictated by applicable legal and regulatory standards and the organization’s retention schedule ensures you stay compliant, support audits and investigations, and manage data responsibly. It also helps protect privacy and reduce unnecessary storage and risk.

This approach is better than indefinite retention, which can expose you to data security risks and higher costs without a legal benefit. It’s more robust than keeping records for a single year, which may be too short for many regulatory, contractual, or historical purposes. And it’s more reliable than stopping retention when a client engagement ends, since other clients or ongoing regulatory requirements may still necessitate retention. By tying the retention period to the lawful and policy-driven schedule, you maintain consistent, defensible records management across all engagements.