Question:  Your organization keeps physical client files in a secure room. Which of the following controls primarily concerns asset retention?  

A.  Restricted access based on job role 

B.  Paper shredding policy

C.  Climate control in the room

D.  Digital backups of the files

Answer: B

Explanation:

Restricted access based on job role: This is primarily a control related to asset access or asset protection, not asset retention. While it's important for safeguarding the physical client files, it doesn't speak to how long those files should be kept or what happens to them when they are no longer needed.

Paper shredding policy: This directly pertains to asset retention. It dictates how long physical files should be kept and outlines the process for their secure disposal once they're no longer needed, thus ensuring that outdated or unnecessary files don't become a security risk.

Climate control in the room: While important for the physical well-being of the files, climate control is more concerned with asset preservation rather than retention. It doesn’t dictate how long files should be kept or what to do with them when they’re no longer needed.

Digital backups of the files: This involves creating digital copies of physical files, which could be considered a form of asset protection or data redundancy. However, it doesn't specifically address the retention period or disposal methods for the physical files themselves.