SI-12(3)

Requirement

Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques].

Discussion

Organizations can minimize both security and privacy risks by disposing of information when it is no longer needed. The disposal or destruction of information applies to originals as well as copies and archived records, including system logs that may contain personally identifiable information.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; personally identifiable information processing procedures; records retention and disposition policy; records retention and disposition procedures; laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal; media protection policy; media protection procedures; system audit records; audit findings; information disposal records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information and records management, retention, and disposition responsibilities; organizational personnel with information security and privacy responsibilities; network administrators].

Test

[SELECT FROM: Organizational processes for information disposition; automated mechanisms supporting and/or implementing information disposition].

ID	Assessment Objectives
SI-12(03)[02]	<SI-12(03)_ODP[02] techniques> are used to destroy information following the retention period;
SI-12(03)[03]	<SI-12(03)_ODP[03] techniques> are used to erase information following the retention period.
SI-12(03)[01]	<SI-12(03)_ODP[01] techniques> are used to dispose of information following the retention period;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!