4.2

Acquisition / Procurement Process

The formal process of purchasing hardware, software, or services, incorporating vendor risk assessments, security requirements, and supply chain checks before onboarding.

Assignment / Accounting - Ownership

Designating a specific individual, team, or department accountable for the security, maintenance, and proper usage of a hardware or software asset.

Assignment / Accounting - Classification

Categorizing assets based on value, sensitivity, and risk to determine the appropriate level of security controls and access restrictions required.

Monitoring / Asset Tracking - Inventory

Maintaining an accurate, up-to-date repository of all physical and virtual enterprise assets, including hardware specifications, software versions, and locations.

Monitoring / Asset Tracking - Enumeration

The active or passive discovery process of identifying and listing all devices, ports, services, and applications active on a network.

Disposal / Decommissioning - Sanitization

The process of removing sensitive data from storage media so that the data cannot be recovered using standard or advanced forensic tools (e.g., purging, zeroization, cryptographic erasure).

Disposal / Decommissioning - Destruction

Physically destroying storage media (e.g., shredding, pulverizing, incinerating, degaussing) to render it completely unusable and unrecoverable.

Disposal / Decommissioning - Certification

Formal documentation (Certificate of Destruction) provided by a vendor or internal team proving that asset data was properly sanitized or physically destroyed according to security standards.

Disposal / Decommissioning - Data Retention

Policies and procedures that dictate how long specific types of data must be kept for business, legal, or regulatory compliance before safe disposal.