3.14.5e

Conduct reviews of persistent organizational storage locations [Assignment: organization defined frequency] and remove CUI that is no longer needed.

DISCUSSION

As programs, projects, and contracts evolve, some CUI may no longer be needed. Periodic and event-related (e.g., at project completion) reviews are conducted to ensure that CUI that is no longer required is securely removed from persistent storage. Removal is consistent with federal records retention policies and disposition schedules. Retaining information for longer than it is needed makes the information a potential target for adversaries searching for critical program or HVA information to exfiltrate. The unnecessary retention of system-related information provides adversaries information that can assist in their reconnaissance and lateral movement through organizational systems. Alternatively, information which must be retained but is not required for current activities is removed from online storage and stored offline in a secure location to eliminate the possibility of individuals gaining unauthorized access to the information through a network. The purging of CUI renders the information unreadable, indecipherable, and unrecoverable.

[SP 800-88] provides guidance on media sanitization.

PROTECTION STRATEGY

Penetration-Resistant Architecture.

ADVERSARY EFFECTS

See [SP 800-160-2]: [Preclude (Expunge, Preempt, Negate); Impede (Degrade, Delay, Exert); Limit (Shorten, Reduce)].

ASSESSMENT OBJECTIVE

Determine if:

3.14.5e_ODP[1] The frequency with which to conduct reviews of persistent organizational storage locations is defined.

3.14.5e[a] Persistent organizational storage locations are identified.

3.14.5e[b] Reviews of persistent organizational storage locations are conducted <3.14.5e_ODP[1]: frequency> to identify CUI that is no longer needed.

3.14.5e[c] CUI that is no longer needed is removed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing the protection of information at rest; system and information integrity policy; procedures addressing non-persistence for system components; system audit records; system design documentation; system configuration settings and associated documentation; security plan; cryptographic mechanisms and associated configuration documentation; offline storage locations for information at rest; system audit records; other relevant documents or records].

Interview: [SELECT FROM: System/network administrators; system developers; organizational personnel responsible for non-persistence; organizational personnel responsible for information security].

Test: [SELECT FROM: Mechanisms supporting and/or implementing the removal of information from online storage; mechanisms supporting and/or implementing the storage of information offline; mechanisms supporting and/or implementing the initiation and termination of nonpersistent components].