# Retention and disposal schedule

SecNet.Work · Assets, CMDB, retention and secure disposal · 2026.10

Derive duration from applicable rationale and start event, not a sample number.

Blank organizational workpaper. Enter real contact, asset and data details only in a controlled organizational copy. This file is not evidence, organizational approval or an automated compliance decision.

- Separate retention duration from periodic-disposal interval.
- Define backup handling and post-restore actions.

| Record category / scope | Purpose / rationale | Information owner | Trigger / duration | Copies / providers | Hold / review | Method / operator / evidence |
| --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |

## Approval and follow-up

| Version | Owner | Approval | Review |
| --- | --- | --- | --- |
|  |  |  |  |

## Official references

- [CISA CRR · Asset Management resource guide](https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf)
- [ServiceNow · CI relationships in the CMDB](https://www.servicenow.com/docs/r/servicenow-platform/configuration-management-database-cmdb/c_CIRelationships.html)
- [NIST SP 800-88 Rev. 2 · September 2025](https://csrc.nist.gov/pubs/sp/800/88/r2/final)
- [NIST SP 800-88r2 · official FAQ](https://csrc.nist.gov/files/pubs/sp/800/88/r2/final/docs/sp800-88r2-faq.pdf)
- [KVKK · Silme, yok etme veya anonim hale getirme yönetmeliği](https://www.kvkk.gov.tr/Icerik/5441/KISISEL-VERILERIN-SILINMESI-YOK-EDILMESI-VEYA-ANONIM-HALE-GETIRILMESI-HAKKINDA-YONETMELIK)
- [GDPR · Articles 5 and 17, official EUR-Lex text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)