Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• TPM-24.3_A01 the required disposition (return, transfer, retention and/or secure destruction) is determined and documented for each category of organizational Technology Assets, Applications, Services and Data (TAASD) held, managed or processed by a third-party before its services cease.
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.3_A02 organizational Technology Assets, Applications, Services and Data (TAASD) designated for return are returned by the third-party.
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.3_A03 organizational Technology Assets, Applications, Services and Data (TAASD) designated for transfer are transferred to the replacement third-party or internally-managed service.
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.3_A04 where organizational Technology Assets, Applications, Services and Data (TAASD) are retained by the third-party after cessation of services (e.g., to satisfy legal or regulatory obligations), the retention period, protection requirements and destruction at the end of the period are documented and agreed.
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.3_A05 organizational Technology Assets, Applications, Services and Data (TAASD) designated for destruction, including copies and backups held by the third-party, are securely destroyed and a written attestation or certificate of destruction is obtained from the third-party.
  Defined parameters: within a defined period after cessation of services, and using methods consistent with NIST SP 800-88 media sanitization guidance
  Assessment rigor: 1
  Origin: SCF Created

Länkade ärenden

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.