Records on a project are any documents or data that provide evidence of the project activities, results, or decisions. Records on a project should be retained until they are no longer useful or required by policy. The retention period of records may vary depending on the type, purpose, and value of the records, as well as the legal, regulatory, or contractual obligations of the organization. Retaining records for the duration of the project, or at the discretion of the record owner, may not be sufficient or consistent with the organization's policies. Retaining records until five years after the project ends, or for the duration of the organization's fiscal year, may not be necessary or appropriate for all records. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 45; CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 1: Security and Risk Management, Question 1.17, page 51.