+CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures (B)
|
CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures (B)
An organisation MUST implement the following minimum procedures for deleting and destroying sensitive storage media. These procedures SHOULD be reviewed and adapted as necessary, depending on the protection needs of the data being processed. - Rewritable digital media that are not encrypted during use MUST be completely overwritten with a data stream of random values (e.g. a PRNG stream).
- If encrypted digital media are used, they MUST be erased through secure deletion of the corresponding key in compliance with the respective crypto concept.
- Optical storage media MUST be destroyed in accordance with security level O-3 (at minimum) as defined in ISO/IEC 21964-2.
- Smartphones and other smart devices SHOULD be encrypted in line with the crypto concept in question. Smartphones and other smart devices MUST be reset to factory settings. The setup process SHOULD then be carried out to complete the deletion.
- IoT devices MUST be reset to factory settings. All the credentials stored in such devices MUST then be changed.
- Paper MUST be destroyed in accordance with security level P-3 (at minimum) as defined in ISO/IEC 21964-2.
- Storage media integrated in other devices MUST be securely erased via the devices' integrated functions. If this is not possible, the mass storage components MUST be removed and either securely erased like conventional digital media from a separate IT system, or destroyed in accordance with security level E-3 or H-3 (at minimum) as specified in ISO/IEC 21964-2.
1. Pregled
1.1 Reference
1.2 Utvrđeni zahtjevi
1.3 Povezani propisi
2. Utvrđeni zahtjevi
3. Povezani propisi
Povezani zadaci
|