Tie retention to sponsor and institutional rules
Pre-award drafts, submitted budgets, award records and rejected-proposal files can have different retention needs. Apply the active award terms, 2 CFR requirements when applicable, institutional schedules and legal holds.
After submission, the research office transfers the final proposal record, inventories local drafts and backups, checks holds and assigns retention or disposal to each copy class instead of deleting everything at once.
Run the control in five steps
- 01Inventory drafts, approvals, submitted files and backups.
- 02Identify sponsor, award and institutional authorities.
- 03Check audits, disputes, claims and legal holds.
- 04Assign keep, delete or sanitize by copy class.
- 05Record final-system transfer and verified disposition.
Preserve the decision trail
Keep proposal, copy class, location, authority, hold check, disposition, date, operator, verification and approver.
Stop and investigate when
- Submission automatically triggers deletion.
- A vault delete action is called guaranteed sanitization.
- Reviewer downloads and backups are absent from the inventory.
State what this does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Sponsor rules, institutional approval, submission systems, provider permissions and recovery remain separate.
Grant budget security questions
Is one retention period universal?
No. Apply the relevant sponsor, award, institutional and legal requirements.
Is ordinary deletion secure erasure?
Not necessarily; use an approved media-appropriate method.
Sources for this decision
Links support specific controls and do not imply endorsement.