Assessment Objective
Determine if:
- SI-12(03)[01] [Assignment: techniques] are used to dispose of information following the retention period;
- SI-12(03)[02] [Assignment: techniques] are used to destroy information following the retention period;
- SI-12(03)[03] [Assignment: techniques] are used to erase information following the retention period.
Assessment Methods
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- personally identifiable information processing procedures
- records retention and disposition policy
- records retention and disposition procedures
- laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal
- media protection policy
- media protection procedures
- system audit records
- audit findings
- information disposal records
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel with information and records management, retention, and disposition responsibilities
- organizational personnel with information security and privacy responsibilities
- network administrators
Test
- Organizational processes for information disposition
- automated mechanisms supporting and/or implementing information disposition
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | SI-12(03) Information Disposal |