Sekit CSF · Data Security · Policy
RCF-0109Data retention & disposal
Secure methods are used to permanently destroy data that is no longer needed
Mapping at a glance
RCF-0109Data retention & disposalData Security · Policy
RCF-0109 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.1Policies for information securitysupportsSekit's Data retention and disposal policy, one of A.5.1's topic-specific policies, sets legal minimums for how long each data category is kept and how it is destroyed afterward.A.5.33Protection of recordssupportsAn approved retention schedule stating how long each data category is kept and how it is securely destroyed supports this control by setting the timeline records must be protected before disposal, though it does not address falsification or access controls.A.7.14Secure disposal or re-use of equipmentsupportsThis policy control sets the retention schedule and secure destruction method for data, the disposal rule A.7.14 requires before equipment carrying that data leaves the company.A.8.10Information deletionsupportsThe retention and disposal policy facet sets how long each data category is kept and the secure method used to destroy it, the schedule A.8.10 requires.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Data retention and disposal procedure
The rules on how long data is kept and how it is securely destroyed when no longer needed.
From the Sekit evidence catalog
This topic through the other lenses
All Data Security controls
Ask Sekura: “What evidence proves RCF-0109?”
Also via MCP, free with account