Requirement
The entity disposes of confidential information to meet the entity’s objectives related to confidentiality.
Points of Focus
Identifies Confidential Information for Destruction
Requirement: Procedures are in place to identify confidential information requiring destruction when the end of the retention period is reached.
Destroys Confidential Information
Requirement: Policies and procedures are in place to automatically or manually erase or otherwise destroy confidential information that has been identified for destruction.
Explanation
Confidential information must be reliably destroyed once it is no longer needed. This criterion requires procedures to flag confidential data whose retention period has ended and to erase or destroy it, automatically or manually. Auditors look for disposal policies, destruction records, and evidence that deletion actually happens on schedule.
