Requirement
The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity’s objectives.
Points of Focus
Removes Data and Software for Disposal
Requirement: Procedures are in place to remove, delete, or otherwise render data and software inaccessible from physical assets and other devices owned by the entity, its vendors, and employees when the data and software are no longer required on the asset or the asset will no longer be under the control of the entity.
Explanation
Before a laptop, server, or drive leaves the entity's control, the data on it must be wiped or destroyed so it cannot be read or recovered. Auditors verify that disposal and repurposing procedures exist, are followed, and produce evidence such as destruction certificates or sanitization logs.
