"Dedicated to providing community consensus minimum standard of procedures, and checklists for overall infrastructure security."
There is no federal legal rule that requires a business to keep evidence for prescribed length of time. Normally, law enforcement will keep for a stipulated period its copies of evidence associated with a prosecution. However, this should not affect a company's decision to keep or not keep material that was used as evidence in a prosecution. Generally, the statute of limitations for a computer crime is five years, which may be used as a guide for corporate document retention policies.