+SI-12(03) Information Disposal
|
SI-12(03) Information Disposal
Control
Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignement: organization-defined techniques].
Discussion
Organizations can minimize both security and privacy risks by disposing of information when it is no longer needed. The disposal or destruction of information applies to originals as well as copies and archived records, including system logs that may contain personally identifiable information.
Assessment Objective
- [Assignement: techniques] are used to dispose of information following the retention period;
- [Assignement: techniques] are used to destroy information following the retention period;
- [Assignement: techniques] are used to erase information following the retention period.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
personally identifiable information processing procedures
records retention and disposition policy
records retention and disposition procedures
laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal
media protection policy
media protection procedures
system audit records
audit findings
information disposal records
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel with information and records management, retention, and disposition responsibilities
organizational personnel with information security and privacy responsibilities
network administrators
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|