12.2.2 The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use …

Requirement

The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (b) provide instructions on the safe use, safe storage, safe transport and the irretrievable deletion and destruction of the assets; (c) provide that the transfer shall take place in a secure manner, in accordance with the type of asset or information to be transferred.

Guidance

• Identify, document and implement a policy for handling assets (103) throughout their life cycle (acquisition, use, storage, transportation and disposal).
• Ensure that the policy includes at least safe storage, safe transport; and irretrievable deletion and destruction. For example:
  • create user manuals and training materials on the correct and secure use of assets;
  • establish guidelines for secure storage, taking into account backup management ( section 4.2);
  • define protocols for secure transfer, including consider secure migration processes, when transferring data to a cloud service;
  • outline methods for data wiping and physical destruction, ensuring complete and irretrievable deletion.
• Ensure that the policy covers the proper usage of all in-scope assets, both on-premises and off-premises (e.g. mobile devices, data in the cloud, transient data (104) or sensitive information).
• Ensure that assets may be transferred to external premises only after approval by authorized management bodies, in accordance with the policy.
• Link the asset handling policy with the asset classification by providing handling details for each classification level.

Examples of evidence

• Documented policy for handling assets.
• User access lists, access request forms and approval records.
• Incident reports related to asset handling (e.g. loss, theft or damage).

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.