Management implements policies, standards and procedures for the disposal or transfer of media and equipment, with risk-based controls set by the data classification and media type, methods defined by data type including physical destruction of media holding sensitive customer information, removal of data even on internal transfers of media such as reissued laptops, procedures for equipment such as printers that hold residual data, periodic review of the timely disposal of decommissioned equipment, and destruction techniques beyond degaussing where residual data on magnetic or flash media could be recovered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.