Finance wants a server holding ten years of contracts retired by quarter end to cut costs. No retention schedule exists and two vendor disputes are open. What should the security manager do FIRST?
A. Archive everything to cloud storage, then wipe the server
B. Confirm retention and legal hold needs with legal and records owners
C. Have records owners delete anything older than seven years
D. Cryptographically erase the drives after a verified backup
(Explain your answer for more points in the comments!)