SOX, ISMS-P, SOC 2 — read as engineering requirements rather than paperwork.
Keep for seven years, delete after ninety days — both halves of a retention policy are provable engineering claims, and most systems can prove neither.
