DIA-3 - Data Lifecycle
Control for managing the complete data cycle from collection to deletion
Control Definition
The stages of the data lifecycle, from creation to destruction, must be defined and managed, establishing security and privacy controls for each one and assigning responsible custodians. Data flows between systems and third parties must be documented, using secure channels and data processing agreements, and their secure, documented destruction ensured at the end of their retention period. The lifecycle must be reviewed periodically to avoid retaining data longer than necessary, and storage media must be managed securely throughout their usage cycle.
Requirements
Requirement 1
We define and manage the stages of the data lifecycle: creation, storage, processing, use, sharing, archiving and destruction.
Requirement 2
We establish the security and privacy controls applicable at each stage of the data lifecycle.
Requirement 3
We identify and train data custodians for each system.
Requirement 4
We document data flows between systems through data flow diagrams (DFDs).
Requirement 5
We require a valid data processing agreement (DPA) for each data transfer to third parties.
Requirement 6
We diagram the business data lifecycle.
Requirement 7
We use encrypted channels and secure protocols (SFTP, HTTPS, MFT) to transfer data between systems and to third parties.
Requirement 8
We ensure the secure destruction of data once retention is no longer needed, with documented evidence in primary systems, backups and third-party systems.
Requirement 9
We manage storage media throughout their lifecycle, from acquisition to disposal, following the information classification criteria.
Requirement 10
We periodically review the lifecycle to ensure data isn't retained longer than necessary.