A penetration test finding is typically handled through remediation, not incident response. The best action is to ensure a corrective plan with milestones is developed so the misconfiguration is fixed, tracked, and validated.

The finance department is the business owner of the vendor relationship and the associated business risk. Therefore, the head of finance is best positioned to define the risk treatment plan (e.g., accept, mitigate via contractual/compensating controls, replace the vendor), with input from IT and information security.

The best course of action is to review the current data retention policy to determine what data should be retained, for how long, and what can be securely deleted. This ensures compliance with legal and regulatory requirements while optimizing storage costs. Encrypting or backing up unnecessary data does not address the root issue of excessive retention, and immediate destruction could lead to compliance violations if required data is deleted.

Explanation
Recovery time objective (RTO) is the length of time from the moment of an interruption until the time the process must be functioning at a service level sufficient to limit financial and operational impacts to an acceptable level. Maximum tolerable outage (MTO) is the maximum time for which an organization can operate in a reduced mode. Recovery point objectives (RPOs) relate to the age of the data required for recovery. Services delivery objectives (SDOs) are the levels of service required in reduced mode.