4 steps to remain compliant with SOX data retention policies