A public-sector agency runs a language model on a private cloud. Its training corpus contains classified citizen records, and policy states such data may be kept only as long as the specific training purpose requires. An audit finds copies of the raw corpus, intermediate feature files and checkpoint snapshots scattered across storage buckets with no expiry. What should the agency do next to align with its obligations?
- ADefine and enforce retention schedules for the corpus, feature files and checkpoints, with secure disposal once the training purpose is met Correct
- BMove all copies to a colder storage tier to reduce the cost of holding the classified data indefinitely
- CTokenise the citizen identifiers within the raw corpus so the records can be kept for future retraining
- DGrant the data science team broader read access so the scattered copies can be consolidated into one bucket
Why A is correct: The finding is uncontrolled retention of AI training artefacts, so setting purpose-bound retention periods and securely disposing of data when no longer needed is the corrective action.
Why B is wrong: Changing storage tier lowers cost but leaves the data retained past its purpose, which is the exact policy breach the audit identified.
Why C is wrong: Tokenisation reduces identifiability but is offered here to justify keeping the data, which still violates the purpose-limited retention requirement rather than satisfying it.
Why D is wrong: Consolidating and widening access addresses sprawl and convenience, not the core problem that classified training data is being retained beyond its permitted period.