Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Data Lifecycle: Integrity, Retention and Disposal
The data life cycle
Integrity
- Input validation and edit checks.
- Reconciliations between systems.
- Access control and segregation of duties.
- Change control over data and programs.
- Integrity checks on archives and backups.
Retention
Example. A company kept every email since 2005. A lawsuit required it to search and disclose 15 years of mail at great cost, and a later breach exposed old customer data it had no reason to keep. A retention schedule fixed both risks.
Secure disposal
Remember data held by suppliers and in backups when planning disposal.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Basis for retention periods | Legal, regulatory and business requirements |
| Litigation expected | Apply a legal hold |
| Risk of keeping data too long | Higher breach and legal exposure |
| Disposal of SSDs or cloud data | Crypto-erase or physical destruction |
In short
- Protection follows data through creation, storage, use, sharing, archiving and destruction.
- Data integrity controls keep data accurate, complete and unaltered: validation, reconciliation and access control.
- Retention schedules come from legal, regulatory, contractual and business requirements.
- Keeping data too long increases breach and legal exposure; legal holds suspend deletion when litigation is expected.
- Secure disposal must match the media and sensitivity, with evidence of destruction.
Exam traps
- Keeping all data forever 'just in case'.
- Deleting data covered by a legal hold.
- Treating file deletion or formatting as secure disposal.
- Forgetting data held by suppliers and in backups.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The data life cycle
Retention
ExampleA company kept every email since 2005. A lawsuit required it to search and disclose 15 years of mail at great cost, and a later breach exposed old customer data it had no reason to keep. A retention schedule fixed both risks.
Secure disposal
1 / 8