CCI-003499

The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in accordance with a NARA-approved record retention schedule.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to dispose of, destroy, erase, and/or anonymize the PII, regardless of the method of storage, in accordance with a NARA-approved record retention schedule.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disposes of, destroys, erases, and/or anonymizes the PII, regardless of the method of storage, in accordance with a NARA-approved record retention schedule.

Compelling Evidence

1.) Site must produce a signed document which describes site's process to dispose of, destroy, erase, and/or anonymize the PII in accordance with a NARA-approved record retention schedule. 2.) Reviewer will verify that the documentation exists. 3.) Reviewer will verify that the documentation contains and describes site's process for disposing of, destroying, erasing, and/or anonymizing the PII in accordance with a NARA-approved record retention schedule. 4.) Reviewer will validate that the site's follows their implemented process by having site's personal demonstrate/describe their process.

The controls below (if any) were marked by NIST as being related to CCI-003499.