Sekit CSF · Data Security · Policy

RCF-0109Data retention & disposal

Secure methods are used to permanently destroy data that is no longer needed

Mapping at a glance

RCF-0109Data retention & disposalData Security · Policy

A.5.1Policies for information securityISO/IEC 27001:2022 · Annex A controls A.5.33Protection of recordsISO/IEC 27001:2022 · Annex A controls A.7.14Secure disposal or re-use of equipmentISO/IEC 27001:2022 · Annex A controls A.8.10Information deletionISO/IEC 27001:2022 · Annex A controls PR.DS-01Data-at-rest protectedNIST CSF 2.0

RCF-0109 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →

Maps to ISO/IEC 27001:2022 · Annex A controls

Curated mapping with the reasoning, not just the codes.

A.5.1Policies for information securitysupportsSekit's Data retention and disposal policy, one of A.5.1's topic-specific policies, sets legal minimums for how long each data category is kept and how it is destroyed afterward.A.5.33Protection of recordssupportsAn approved retention schedule stating how long each data category is kept and how it is securely destroyed supports this control by setting the timeline records must be protected before disposal, though it does not address falsification or access controls.A.7.14Secure disposal or re-use of equipmentsupportsThis policy control sets the retention schedule and secure destruction method for data, the disposal rule A.7.14 requires before equipment carrying that data leaves the company.A.8.10Information deletionsupportsThe retention and disposal policy facet sets how long each data category is kept and the secure method used to destroy it, the schedule A.8.10 requires.

Maps to NIST CSF 2.0

Curated mapping with the reasoning, not just the codes.

PR.DS-01Data-at-rest protected PR.DS-10Data-in-use protected

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Data retention and disposal procedure

The rules on how long data is kept and how it is securely destroyed when no longer needed.

From the Sekit evidence catalog

This topic through the other lenses

All Data Security controls

Ask Sekura: “What evidence proves RCF-0109?”

Connect your AI · free MCP

https://sekit.ai/api/mcp/crosswalk

In Claude or ChatGPT, add a custom connector and paste this URL.
Sign in with your email to finish. Free, read-only, no organization required.