your organization requires that metrics from all applications be retained for 5 years for future analysis in possible legal proceedings. which approach should you use?