2023-13 – Retention periods are not met
| Veld | Waarde |
|---|---|
| Status | Actief |
| Behandeling | Accepteren |
| Kans | Midden |
| Impact | Midden |
| Blootstelling | Midden |
| Restblootstelling | Laag |
| Eigenaar | Management |
| Verantwoordelijke | Security Officer |
Asset
Confidential information stored digitally or physically
Dreiging
e.g. when 1. Information is not retained long enough (e.g. financial/tax data) 2. Information is retained too long (e.g. PII)
Risicocategorie
Vertrouwelijkheid, Beschikbaarheid
Risicoscore
| Kans | Impact | Blootstelling | Restblootstelling |
|---|---|---|---|
| Midden | Midden | Midden | Laag |
Behandelingsmaatregelen
- Investigate applicable retention periods in Information retention policy (A.5.33 Protection of records)
- Define procedures for timely removal (A.5.37 Documented operating procedures)