As part of the asset management life cycle, a company engages a certified equipment disposal vendor to appropriately recycle and destroy company assets that are no longer in use. As part of the…

Question

Options

• AA copy of the vendor's information security policies.
• BA copy of the current audit reports and certifications held by the vendor.
• CA signed NDA that covers all the data contained on the corporate systems.
• DA copy of the procedures used to demonstrate compliance with certification requirements.

• A
  7% (3)
• B
  14% (6)
• C
  2% (1)
• D
  76% (32)

Explanation

For a certified equipment disposal vendor, obtaining the actual procedures used to demonstrate compliance with their certification requirements provides the organization with operational assurance about how equipment and data are physically handled, sanitized, and destroyed. Certifications and audit reports (B) confirm the vendor passed an assessment at a point in time but do not reveal the 'how.' Security policies (A) are high-level governance documents. An NDA (C) provides legal protection but no operational assurance that data is properly destroyed. Procedures (D) give direct visibility into the destruction and sanitization workflow, which is the core risk being managed when disposing of assets containing sensitive data.

No community discussion yet for this question.