C1.2

C1.2

The entity disposes of confidential information to meet the entity’s objectives related to confidentiality.

Category

Confidentiality

Subcategory

Additional Criteria for Confidentiality

Points of Focus

Identifies Confidential Information for Destruction

Procedures are in place to identify confidential information requiring destruction when the end of the retention period is reached.

Destroys Confidential Information

Policies and procedures are in place to automatically or manually erase or otherwise destroy confidential information that has been identified for destruction.

Evidence Requests

Area of Focus	Artifact	Description
Asset Management	Data Retention Program	Documented evidence of a formal data retention program that governs the retention and destruction of data types.
Privacy	Authorized Use	Documented evidence of authorized use definitions for privacy-related data operations.

Policies

• Data Management Policy - Establishes requirements for data classification, handling, and protection
• Privacy Policy - Defines requirements for protecting personal information and privacy