Data Lifecycle & Retention

Protecting CUI includes retaining it for the required period and disposing of it under an approved schedule. NIST SP 800-171 Rev. 3 03.14.08 (Information Management and Retention) covers CUI retention. Audit-record retention is in 03.03.03 (Audit Record Generation); 03.03.07 covers time stamps, not retention periods (NIST Rev. 3). See Audit Readiness for log retention.

Microsoft Purview addresses this with two complementary solutions:

• Data Lifecycle Management: retain or delete content automatically with retention policies and retention labels (overview).
• Records Management: for high-value or regulated records: a file plan, records declaration, and disposition review with proof of disposition (overview).

Retention policies vs. retention labels

Both can retain-then-delete, retain-only, or delete-only. Choose by scope:

	Retention policy	Retention label
Scope	Workload / location (Exchange, SharePoint, OneDrive, M365 Groups, Teams)	Item level (folder, document, email)
Applied	Automatically across a location	Manually, auto-applied (SIT / keyword / trainable classifier), or as a default
Travels with content	No	Yes: within the tenant, if the item moves
Advanced	—	Event-based start, disposition review, declare as a record, proof of disposition

(Source: retention policies and labels.)

Rule of thumb: a retention policy sets the baseline for a whole site or mailbox; a retention label handles item-level exceptions and anything that must become a defensible record.

Recommended baseline

1. Baseline retention policies for Exchange, SharePoint, OneDrive, and Teams, using the supported workload/location combinations. Teams messages and their SharePoint/OneDrive files need the appropriate separate coverage. Choose retention and deletion actions from the approved schedule and applicable holds.
2. A CUI retention label, auto-applied to CUI by reusing the SITs / trainable classifiers from Sensitivity Labels and Sensitive Information Types, with the retention period your contract or CUI category requires and disposition review at the end, so CUI is never auto-deleted without a human decision.
3. Records declaration where the records schedule requires it. Standard records can support unlock/edit workflows, and property editing can remain allowed; regulatory records have stricter restrictions. Validate the record behavior instead of treating every declaration as immutable. A record label also does not replace an eDiscovery legal hold.

Disposition & proof

At the end of a retention period a label can start a disposition review instead of auto-deleting: designated reviewers approve deletion, extend retention, or relabel, and Purview retains proof of disposition for up to seven years (disposition). That proof is the artifact demonstrating CUI was disposed of deliberately and on schedule, exactly what 03.14.08 asks you to show.

Evidence for assessment

• 03.14.08 (Information Management and Retention): the retention policy/label configuration, the file plan, and disposition-review records / proof-of-disposition exports.
• Retention is itself audited: admin configuration of retention policies/labels, and (for labels) retention actions, are written to the Unified Audit Log (auditing retention); pair this with Audit Readiness.

Licensing

Creating and publishing retention labels and basic retention policies are included at the Microsoft 365 / Office 365 E3 level. The advanced capabilities (event-based retention, disposition review, declaring records / regulatory records, and auto-relabel at end of period) require E5 / G5 or the Purview add-on (Purview service description).

GCC High

Core retention policies and labels are available in Microsoft Purview for GCC High. Availability of specific advanced Records Management features (event-based retention, regulatory records, disposition-review options) in the sovereign cloud is unverified here; confirm in the Purview portal / the Microsoft 365 GCC High service description before committing them to your SSP.