CC6.5
CC6.5
The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity’s objectives.
Category
Security
Subcategory
Logical and Physical Access Controls
Points of Focus
Removes Data and Software for Disposal
Procedures are in place to remove, delete, or otherwise render data and software inaccessible from physical assets and other devices owned by the entity, its vendors, and employees when the data and software are no longer required on the asset or the asset will no longer be under the control of the entity.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Asset Management | Asset Disposal Evidence | Documented evidence of asset disposal/destruction (e.g., asset tracking by serial # for shredding, degaussing, etc.). |
| Cryptographic Protections | Cryptographic Protections | Documented evidence of organization-approved cryptographic solutions and modules for both data at rest and in transit. |
| Data Protection | Media Sanitization Documentation | Documented evidence of media sanitization actions. |
| Asset Management | Data Retention Program | Documented evidence of a formal data retention program that governs the retention and destruction of data types. |
| Privacy | Authorized Use | Documented evidence of authorized use definitions for privacy-related data operations. |
Policies
- Asset Management Policy - Defines requirements for identifying, tracking, and managing organizational assets
Example Organization Controls
- CC6.5.1 - Data classification policies and procedures are documented and implemented.
- CC6.5.2 - Data disposal and destruction policies and procedures are documented and implemented.
Example Control Objectives
- Data protection and classification - Data is classified and protected from unauthorized disclosure throughout its lifecycle.
Example Evidence
- Data Classification Procedures - Documented and implemented data classification policies and procedures per the Data Classification Policy
- Data Disposal Records - Records demonstrating data disposal and destruction procedures are documented and implemented