CCI-005146

Defines the techniques or methods used to dispose of organization-defined data, documentation, tools, or system components.

Implementation Guidance

Determine if [SR-12_ODP[01]; data, documentation, tools, or system components to be disposed of are defined] are disposed of using [SR-12_ODP[02]; techniques and methods for disposing of data, documentation, tools, or system components are defined].

Validation Procedures

Examine: [SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; disposal procedures addressing supply chain protection; media disposal policy; media protection policy; disposal records for system components; documentation of the system components identified for disposal; documentation of the disposal techniques and methods employed for system components; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system component disposal responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain protection responsibilities]. Test: [SELECT FROM: Organizational techniques and methods for system component disposal; mechanisms supporting and/or implementing system component disposal].

The controls below (if any) were marked by NIST as being related to CCI-005146.