No fixed retention period applies; the purpose sets it, and the period should be the shortest the purpose needs, after which footage should be deleted. It should not be set by storage capacity or the manufacturer's default (six months merely because the system allows it) or kept in case it proves useful; the policy should be documented and understood by operators, deletion should be permanent and secure, and adherence should be checked. Longer retention can be justified for a specific purpose, such as preserving footage at the request of police investigating a crime.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.