6.8.2 Equipment
Equipment controls apply across siting, utilities, cabling, maintenance, removal and off premises use, and additionally the organization must ensure that reassigned storage space leaves no accessible personal data behind
5
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Hardcopy minimisation rules and clear desk enforcement evidence · Physical access / facilities
- Equipment maintenance and off premises use records · Physical access / facilities
governing documentDocuments that govern the control
- Storage reassignment procedure with evidence that residual data is not accessible · Policy repository / GRC workspace
- Technical measures documented where explicit erasure is impractical, such as cryptographic erasure · Document repository
- Disposal and reuse procedure treating suspect media as containing personal data · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Virtualised or cloud storage reassigned with reliance on the provider and no assurance obtained
- Deletion treated as erasure, leaving data recoverable by the next tenant of the storage
- Media of unknown content disposed of as clean because nobody checked
- Hardcopy minimisation stated in policy while reports containing personal data print on a schedule
- Equipment sent for repair with storage still installed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.8.1 Secure areas · 6.9.1 Operational procedures and responsibilities