Asset classification, handling and inventory
Catalog reference
Set classification levels for all assets, information included, link each asset to a level by its confidentiality, integrity, authenticity and availability needs, align availability needs with your recovery objectives, and review the levels periodically. Set and communicate a policy for handling assets over their whole life (acquisition, use, storage, transport and disposal), including secure transfer and irreversible deletion. Set a removable media policy with a technical ban unless there is an organisational reason, scanning of media, protection of portable storage in transit and at rest, and cryptography where fitting. Keep a complete, accurate, current and consistent inventory of assets, covering operations and services and the systems and assets that support them, with traceable changes, reviewed regularly. Make sure assets held by staff are handed in, returned or removed when employment ends, and documented, and cut off access of any asset that cannot be recovered. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Narrative — how we satisfy this requirement
No narrative yet. Add one.