Backup retention is usually set once by whoever installed the system and never revisited. Thirty days here, a year there, whatever the default allowed. Then a claim arrives about a project that finished years ago, or ransomware is discovered weeks after it got in, and the retention setting becomes a business problem.
Construction records have long lives. Disputes, warranty issues, and audits can surface well after the final pay application. Setting retention on purpose is worth an hour of leadership time.
Two Different Questions
It helps to separate two concepts that often get blurred:
- Records retention is how long you must or should keep business records, regardless of where they live.
- Backup retention is how far back your recovery copies reach, so you can restore a system to an earlier state.
A backup is not a records archive, and an archive is not a backup. They serve different purposes and are managed differently.
Backup Retention: Think About Recovery
Backup retention should answer: how far back might we need to go to get a clean copy?
Consider:
- Ransomware dwell time. Attackers may be inside for days or weeks before encrypting. If your oldest backup is only a few days old, it may already be tainted. Longer history gives you a path to a clean state.
- Slow-discovery errors. Accidental deletion or corruption may go unnoticed for weeks or months, especially in rarely used folders.
- Accounting cycles. Month-end, quarter-end, and year-end snapshots are often valuable for correcting errors or answering auditors.
- Storage cost. Longer retention costs more, though thinning older copies from daily to weekly to monthly keeps it manageable.
A common structure keeps frequent recent copies, weekly copies for a few months, monthly copies for a year or more, and annual copies longer for critical systems like accounting. Your provider can model storage costs for options.
Records Retention: Think About Obligations
Records retention is driven by outside requirements. Typical sources include:
- Contract terms with owners and general contractors
- Applicable statutes, including those governing construction defect claims, which vary by state
- Tax and payroll record rules
- Safety and environmental recordkeeping requirements
- Insurance policy conditions
- Lender and surety requirements
- Government contract terms
Do not guess. Ask your attorney, accountant, and insurance broker for the right periods, then write a retention schedule listing each record type, its retention period, and the owner.
Legal Holds
A legal hold, sometimes called a litigation hold, is an instruction to preserve information because a claim or investigation is reasonably anticipated. When one is issued, routine deletion of relevant data must stop. That includes email, project files, text messages, and backups.
Prepare for it:
- Know who can issue a hold, typically counsel or leadership acting on counsel's advice
- Be able to suspend automatic deletion for specific mailboxes, folders, or systems quickly
- Know how to preserve relevant backup sets so they are not rotated out
- Document what was preserved and when
- Notify affected staff, including field personnel who may keep information on phones and tablets
Failing to preserve evidence can have serious consequences in a dispute. Talk to counsel about your obligations.
Align Systems With the Schedule
Once you have a schedule, configure the tools to match:
- Email and file retention policies in Microsoft 365
- Project platform archive and deletion settings
- Backup rotation and long-term copies
- Disposal of old devices and media, with documented wiping
Where cloud platforms delete data automatically, understand the default and change it deliberately.
Dispose of Data on Time
Keeping everything forever is not free. Old data increases the cost of backups, the scope of discovery in a dispute, and the damage from a breach. Once retention periods have passed and no hold applies, delete data in a documented, authorized way.
Protect Long-Term Copies
Archives that sit for years need protection too. Encrypt them, restrict access, test occasional restores, and make sure the format remains readable. Old backups tied to retired software can become unusable if nobody keeps a way to open them.
Keep a Simple Record
Maintain one page showing the retention schedule, the systems it applies to, the person responsible, and the date of last review. Revisit annually and when contracts or regulations change.
Getting Help
Ironfield Cyber helps contractors align backup policies with their records obligations and set up the tooling to support legal holds. If you want help translating your retention schedule into actual system settings, we can work with your counsel and accountant.