Asset Security: Classification, Ownership, Lifecycle, and Secure Disposal
What this domain tests
Domain 2 tests how information is classified, who is accountable for it, how handling rules follow it through its lifecycle, and how it is destroyed when no longer needed. Privacy obligations and data remanence questions appear frequently because they expose the difference between deleting a reference and erasing the data.
Core rules
- The classification scheme is business-driven and approved by data owners, not invented by IT. Labels such as public, internal, confidential, and restricted drive handling requirements for storage, transmission, and sharing; government schemes use a parallel structure.
- Roles are distinct. The owner is a senior manager accountable for the asset who sets classification and approves access. The custodian/steward implements and operates controls such as backups, encryption, and storage. Users follow policy. Under privacy law, a controller determines purpose and means while a processor acts on the controller's instructions.
- Lifecycle stages are create, store, use, share, archive, and destroy. Retention periods come from legal, regulatory, contractual, and business requirements, and destruction happens at the end of the period rather than when storage fills up.
- Scoping must include every replica: backups, disaster-recovery copies, SaaS tenants, analytics extracts, and test data. A control that misses replicas misses most of the exposure.
- Sanitization follows NIST SP 800-88: clear (logical techniques allowing reuse in the same environment), purge (stronger, resistant to laboratory recovery), and destroy (physical destruction). Overwriting suits magnetic hard drives; degaussing destroys hard drives but not flash media; self-encrypting drives support cryptographic erase; shredding or incineration handles physical media.
- Privacy principles include data minimization, purpose limitation, and honoring data subject rights such as access, rectification, and erasure, plus constraints on cross-border transfer.
Worked example
Three hundred laptops with solid-state drives are retired after holding confidential client files. Overwriting is unreliable on flash because wear leveling and spare blocks can retain data, and degaussing has no effect on flash. The correct path is crypto-erase for self-encrypting drives or physical destruction otherwise, with a certificate of destruction, an inventory update marking the assets disposed, and the same treatment extended to backup tapes and the decommissioned SAN that held the same data.
Traps that cost marks
- Naming the custodian as the party who decides classification.
- Treating file deletion or formatting as sanitization.
- Forgetting cloud provider copies and backups when scoping disposal.
- Retaining data indefinitely with no legal basis, or destroying it while a legal hold applies.