12.2.2 The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use …

Requirement

The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (b) provide instructions on the safe use, safe storage, safe transport and the irretrievable deletion and destruction of the assets; (c) provide that the transfer shall take place in a secure manner, in accordance with the type of asset or information to be transferred.

Guidance

• Identify, document and implement a policy for handling assets (103) throughout their life cycle (acquisition, use, storage, transportation and disposal).
• Ensure that the policy includes at least safe storage, safe transport; and irretrievable deletion and destruction. For example:
  • create user manuals and training materials on the correct and secure use of assets;
  • establish guidelines for secure storage, taking into account backup management ( section 4.2);
  • define protocols for secure transfer, including consider secure migration processes, when transferring data to a cloud service;
  • outline methods for data wiping and physical destruction, ensuring complete and irretrievable deletion.
• Ensure that the policy covers the proper usage of all in-scope assets, both on-premises and off-premises (e.g. mobile devices, data in the cloud, transient data (104) or sensitive information).
• Ensure that assets may be transferred to external premises only after approval by authorized management bodies, in accordance with the policy.
• Link the asset handling policy with the asset classification by providing handling details for each classification level.

Examples of evidence

• Documented policy for handling assets.
• User access lists, access request forms and approval records.
• Incident reports related to asset handling (e.g. loss, theft or damage).

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -