The organization approves a taxonomy of data lifecycle stages; specifies the metadata needed to automate lifecycle management and controls (by data domain, sensitivity, legal ownership and location); defines storage-tiering policy as data moves through the stages (driven by metadata including age, date last modified or accessed, lifecycle status and domain, within business requirements for availability, resilience, retrieval and retention); defines policy and standards for where data is placed, how long it is kept and how it is disposed of, in line with applicable rules; addresses lifecycle exceptions such as e-discovery requests, legal holds and right-to-be-forgotten requests; and sets standards for secure disposal so data cannot be recovered from storage media by any reasonable forensic means. The framework is approved by all key stakeholders and applies on-premises and in the cloud.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.