Requirement
The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality.
Points of Focus
Defines and Identifies Confidential information
Requirement: Procedures are in place to define, identify, and designate confidential information when it is received or created.
Retains Confidential Information
Requirement: Confidential information is retained for no longer than necessary to fulfill the identified purpose, unless a law or regulation specifically requires otherwise.
Protects Confidential Information From Destruction
Requirement: Policies and procedures are in place to protect confidential information from erasure or destruction during the specified retention period of the information.
Explanation
An organization must know which information it has promised to keep confidential and protect it for as long as it is retained. This criterion covers identifying and labeling confidential data when received or created, retaining it no longer than needed, and guarding it against premature erasure. Auditors test classification procedures and retention safeguards.
