Asset Security
Asset Security tests how organizations classify, own, retain, and destroy information and media across their lifecycle.
Core rules
- Inventory assets and assign a data owner accountable for classification and access decisions; custodians implement handling. Classification drives labeling, storage, transmission, and disposal.
- Common tiers are public, internal, confidential, and restricted; use the organization’s scheme, not a generic one. PII, PHI, and cardholder data trigger legal or contractual duties.
- Retention schedules keep data only as long as needed for business, legal, or regulatory reasons. Legal hold suspends deletion.
- Data remanence is residual data on media. Sanitization methods include clearing, purging, and destruction; NIST SP 800-88 guides media sanitization. Cryptographic erase is effective only if keys are destroyed and not backed up.
- DLP monitors or blocks sensitive data movement, but policy and classification must come first.
Worked example
A laptop with customer records is retired. Deleting files is insufficient because remanence may remain and backups may exist. The owner confirms retention has expired, legal hold is clear, and the asset is inventoried. The drive is cryptographically erased by destroying all keys, or physically destroyed if required. The custodian records the method and date. The reasoning ties classification and retention to a defensible disposal decision.
Traps
The data owner is accountable; the IT custodian is not the owner. Retention is not the same as backup. Clearing is weaker than purging. Encryption without key destruction is not cryptographic erase. Public data still needs integrity protection.