CC6.5 Discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity's
Discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity's.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Sanitisation or destruction records for each asset released, naming the method used and the operator · Physical access / facilities
- Verification evidence that the ability to read or recover data and software has been diminished, such as verification passes or destruction certificates · Physical access / facilities
- Evidence the requirement for the asset was formally determined to have ended before protections were removed · Physical access / facilities
governing documentDocuments that govern the control
- Documented procedure defining when protections may be discontinued and what sanitisation must precede it · Policy repository / GRC workspace
- Asset register entries showing the transition from in use to sanitised to released, with dates · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Assets released to disposal or resale with protections removed before sanitisation is confirmed, reversing the required order
- Certificates of destruction accepted from a vendor with no serial level reconciliation against the assets sent
- Encrypted media treated as sanitised by key destruction with no record of where else that key was held
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC6.4 Restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives · CC6.6 Measures against threats outside system boundaries are implemented