Asset Security
Classification and ownership
Data is protected according to its value. Classification schemes (public, internal, confidential, restricted, or regulatory labels such as PII and PHI) drive labeling, handling, retention, and destruction. Know the roles: the data owner is a senior business manager accountable for the asset and its classification; the custodian implements the controls; the steward handles quality and content; the user follows policy. When a question asks who decides, the answer is almost always the owner, not IT.
The lifecycle is create, classify, store, use/share, archive, destroy, and each phase has its own controls: encryption at rest, DLP, retention schedules, sanitization.
Sanitization
Separate clearing, purging, and destruction (NIST SP 800-88). Overwriting is acceptable when media is reused; degaussing works only on magnetic media and leaves the drive unusable; physical destruction is the safe path for failed drives and solid-state media, where wear leveling hides data. Remanence is the residue that survives inadequate erasure.
Privacy
Know the principles: lawful basis, purpose limitation, minimization, accuracy, storage limitation, integrity and confidentiality, accountability. GDPR adds data subject rights and breach notification timelines. The trap is treating privacy as a purely IT problem.
Worked example
An HR array holding 5,000 records is retired after a move to cloud HR. Overwriting is proposed because it is cheap. The correct choice is physical destruction or verified crypto-erasure, because residual recoverability on modern drives drives the decision; the data owner authorizes disposal and evidence of destruction is retained.