DCH-08: Physical Media Disposal

There is no evidence of a capability to securely dispose of media when it is no longer required, using formal procedures.

C|P-CMM1 is N/A, since a structured process is required to securely dispose of media when it is no longer required, using formal procedures.

Data Classification & Handling (DCH) efforts are requirements-driven and governed at a local/regional level, but are not consistent across the organization. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Document where sensitive/regulated data is stored, transmitted and processed to identify data repositories and data flows. o Create and maintain Data Flow Diagrams (DFDs) and network diagrams. o Are expected to take the initiative to work with Data Protection Officers (DPOs) to ensure applicable statutory, regulatory and contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data o Geolocation requirements for sensitive/regulated data types, including the transfer of data to third-countries or international organizations. o Requirements for minimizing data collection to what is necessary for business purposes. o Requirements for limiting the use of sensitive/regulated data in testing, training and research.

• Data management is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
• IT/cybersecurity personnel identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for data management.
• Data protection controls are primarily administrative and preventative in nature (e.g., policies & standards) to classify, protect and dispose of systems and data, including storage media.
• A data classification process exists to identify categories of data and specific protection requirements.
• A data retention process exists and is a manual process to govern.
• Data/process owners:
• A manual data retention process exists.
• Content filtering blocks users from performing ad hoc file transfers through unapproved file transfer services (e.g., Box, Dropbox, Google Drive, etc.).
• Mobile Device Management (MDM) software is used to restrict and protect the data that resides on mobile devices.
• Physical controls, administrative processes and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
• Administrative means (e.g., policies and standards) dictate:

Data Classification & Handling (DCH) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Are expected to take the initiative to work with Data Protection Officers (DPOs) to ensure applicable statutory, regulatory and contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data. o Maintain decentralized inventory logs of all sensitive/regulated media and update sensitive/regulated media inventories at least annually. o Create and maintain Data Flow Diagrams (DFDs) and network diagrams. o Document where sensitive/regulated data is stored, transmitted and processed in order to document data repositories and data flows.

• A Governance, Risk & Compliance (GRC) function, or similar function, assists users in making information sharing decisions to ensure data is appropriately protected, regardless of where or how it is stored, processed and/ or transmitted.
• A data classification process exists to identify categories of data and specific protection requirements.
• A data retention process exists to protect archived data in accordance with applicable statutory, regulatory and contractual obligations.
• Data/process owners:
• Devices are escrowed in storage for a period of time before being wiped and reissued, in case data on the devices are needed for investigations or business purposes.

Data Classification & Handling (DCH) efforts are metrics driven and provide sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:

• Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
• Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
• Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
• Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
• Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
• Both business and technical stakeholders are involved in reviewing and approving proposed changes.

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to securely dispose of media when it is no longer required, using formal procedures.