SR-12

Requirement

Dispose of [Assignment: organization-defined data, documentation, tools, or system components] using the following techniques and methods: [Assignment: organization-defined techniques and methods].

Discussion

Data, documentation, tools, or system components can be disposed of at any time during the system development life cycle (not only in the disposal or retirement phase of the life cycle). For example, disposal can occur during research and development, design, prototyping, or operations/maintenance and include methods such as disk cleaning, removal of cryptographic keys, partial reuse of components. Opportunities for compromise during disposal affect physical and logical data, including system documentation in paper-based or digital files; shipping and delivery documentation; memory sticks with software code; or complete routers or servers that include permanent media, which contain sensitive or proprietary information. Additionally, proper disposal of system components helps to prevent such components from entering the gray market.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; disposal procedures addressing supply chain protection; media disposal policy; media protection policy; disposal records for system components; documentation of the system components identified for disposal; documentation of the disposal techniques and methods employed for system components; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system component disposal responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain protection responsibilities].

Test

[SELECT FROM: Organizational techniques and methods for system component disposal; mechanisms supporting and/or implementing system component disposal].

ID	Assessment Objectives
SR-12	<SR-12_ODP[01] data, documentation, tools, or system components> are disposed of using <SR-12_ODP[02] techniques and methods>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!