Retention expires on a drive under hold
The scheduled period expired, but a validated legal hold covers the same data. What should happen?
SecNet.Work · 2026.10 · Sources checked: 2026-10-21
Assets, CMDB, retention and secure disposal
Asset management goes beyond counting devices. Information ownership, application dependencies, device lifecycle and retained copies form one control chain. This guide connects inventory to a usable service map, then addresses retention, legal holds, reuse and evidence-based disposal. Examples are fictional and contain no real personal information or device secrets.
Original AI-assisted SecNet educational content. Examples are fictional, not publication or endorsement by referenced organizations. Implementation decisions require organization-specific approval.
Process map
Select a step to see its owner, action and exit evidence.
Create the record
- Owner
- Asset owner + procurement
- Action
- Assign unique identity and ownership to information, equipment, software and services.
- Exit evidence
- Accepted inventory with source and date.
Contents and quick navigation
- Concepts
- Why asset management underpins security
- What belongs in a useful inventory record?
- Why CMDB is distinct and useful
- How to maintain and measure CMDB quality
- Lifecycle from acquisition to return and disposition
- How to define a retention period
- KVKK and GDPR: distinguish different clocks
- Legal holds, backups and cloud copies
- Deletion, sanitization, anonymization and destruction
- How to establish custody and disposal evidence
- Assurance questions, measures and implementation
- Decision practice
- Downloadable workpapers
Put the concepts in context
- Asset / varlık
- Information, equipment, software, a service or another resource that provides value and needs management.
- ITAM
- Management of acquisition, ownership, cost, licensing, use and disposition across the IT asset lifecycle.
- CI
- A configuration item whose configuration/relationships are controlled to deliver a service; it need not be physical equipment.
- CMDB
- A configuration-management database holding CIs, defined directional relationships and evidence of their validity.
- Retention / saklama
- A rule defining how long a record category is kept, using a justified period and start event.
- Legal hold
- An authorized preservation measure for a defined dispute/obligation, with bounded scope and review.
- Chain of custody
- The trace of who transferred a device/media item to whom, when, under which identity and condition.
- Clear / purge / destroy
- Clear addresses logical access; purge addresses more advanced recovery; destroy makes media unusable for storing data. Choose the method for the media and required assurance.
- Sanitization
- Controlled treatment intended to make target data inaccessible at a defined assurance level; different from ordinary file deletion.
- Cryptographic erase
- A method that denies data access by making the relevant keys unusable, subject to suitable encryption and key-lifecycle conditions.
- Anonimleştirme / anonymization
- Removing linkability to a person; replacing identity with a code alone is generally pseudonymization.
Why asset management underpins security
You cannot reliably scope patching, backup, access or disposal without knowing what must be protected. Include SaaS tenants, cloud accounts, virtual machines, network/OT/mobile devices, licences, certificates and critical information sets alongside laptops and servers. Choose fields for each category rather than expecting a financial fixed-asset list to answer every security question.
An information owner may decide use/classification; a custodian operates controls; a user accepts custody and usage duties. Do not blur these roles into one name. Reconcile procurement, HR, finance, security and IT records and route unknown/ownerless items for decisions. Use approved discovery suited to the environment, avoiding unauthorized scans or aggressive OT discovery.
Related primary references: CISA CRR · Asset Management resource guide ↗
What belongs in a useful inventory record?
Choose a durable identity such as serial number, hardware UUID, cloud resource ID or organizational asset ID. An IP address alone is not identity because it can be reassigned. Distinguish source, last-seen and last-validated dates. Reconcile duplicates from different tools using defined matching rules and exception review.
A new discovery may not be a new purchase; an unseen item is not automatically disposed. Investigate changes and absences. Protect inventory access itself: do not place passwords, private keys or access tokens in descriptions; use authorized references to secure secret storage. Limit personal custody details to roles that need them.
| Field group | Example fields | What it enables |
|---|---|---|
| Identity and scope | Asset/CI ID, type, serial or resource ID | Unique tracking and scope reconciliation |
| Accountability | Business owner, custodian, service | Decision and corrective-action ownership |
| Lifecycle | State, location, custody, warranty/EOL | Renewal, return and disposal planning |
| Protection | Classification, patch, EDR, backup, encryption reference | Service impact of missing controls |
| Trustworthiness | Source, last seen, validator, relationship date | Tracking ownerless, stale and duplicate records |
Related primary references: CISA CRR · Asset Management resource guide ↗
Why CMDB is distinct and useful
Inventory answers what equipment exists and who holds it. CMDB uses configuration-item relationships to explain which services a change affects. CIs can include servers, application services, databases and business services. An asset and CI are not always one-to-one. ITAM may manage financial value/custody while CMDB manages operational dependencies.
Model a fictional order service through application → database → storage and application → identity/DNS/key services. Define meaning and direction instead of vague “connected” relationships: runs on, reads from, authenticates through, backed up by. Have the service owner validate the map. Then maintenance impact, recovery order, vulnerability priority and change approval can use the same service model.
| Source CI | Relationship | Target CI / impact |
|---|---|---|
| Order service | delivered by | Order API · transaction capacity |
| Order API | reads/writes | Order DB · consistency and RPO |
| Order API | authenticates through | Identity service · access dependency |
| Order DB | recovered from | Backup set + key · restore dependency |
Related primary references: ServiceNow · CI relationships in the CMDB ↗
How to maintain and measure CMDB quality
Start with a few critical business services. Define classes, required attributes, relationship vocabulary, authoritative sources and update owners. Discovery can supply observed technical data; procurement validates licensing/warranty; service owners validate business relationships. Specify authority per field when sources conflict instead of assuming the newest arrival is correct.
Installation, relocation, change, incident, return and disposal workflows should include their CI updates before closure. Track missing required fields, ownerless critical CIs, relationships beyond validation thresholds, duplicate identities and unmapped assets. Report discovery blind spots separately; do not hide an unknown population in an apparently complete percentage.
Related primary references: ServiceNow · CI relationships in the CMDB ↗CISA CRR · Asset Management resource guide ↗
Lifecycle from acquisition to return and disposition
Connect need → security requirements → purchase → acceptance → custody/deployment → operation/change → return/quarantine → reuse or disposal. At acceptance verify hardware identity, support lifetime, secure configuration and required licences. During employee exit check accounts, tokens, certificates and remote-management status as well as physical return.
Failed drives, leased equipment and warranty/RMA returns can expose data. If sanitization is impossible before return, use controlled retention, a drive-retention agreement, authorized destruction or another approved solution. The accountable owner should decide warranty-versus-data-risk trade-offs. Do not mark CMDB/financial records disposed before evidence exists.
Related primary references: NIST SP 800-88 Rev. 2 · September 2025 ↗
How to define a retention period
For each record category identify purpose, applicable country/sector obligations and the event starting the clock. It may begin at creation, contract termination, account closure or another approved trigger. Assess minimum duties, purpose-based necessity, limitation periods and excess-retention risk together; “keep everything ten years” is not a defensible schedule.
A schedule needs category, scope, owner, legal/business rationale, trigger, duration, review, copies, holds, method, operator and evidence. Expiry can affect applications, shared folders, email attachments, analytical derivatives and supplier copies. Assign approval and validation as well as technical execution; handing deletion to IT does not complete governance.
| Category | Start event | Determining duration | Closure evidence |
|---|---|---|---|
| Candidate application | Recruitment process closes | Separate recruitment purpose, applicable claims and any talent-pool decision | Operation record covering copies and recipients |
| Security event log | Event recording or approved case closure | Assess investigation needs, sector duties and proportionate access | Policy version, deletion job and sample validation |
| Contract / financial record | Defined contract or accounting event | Determine applicable law and record-specific duties | Approval, hold check and result |
| Backup copy | Copy creation and rotation schedule | Design recovery purpose, versions and retention/access boundaries together | Rotation and deletion-rule reapplication after restore |
Related primary references: GDPR · Articles 5 and 17, official EUR-Lex text ↗
KVKK and GDPR: distinguish different clocks
Under the KVKK disposal regulation, the periodic-disposal interval for the policy framework is at most six months; this is not a six-month retention rule for all data. A three-month rule applies after the obligation arises for controllers not obliged to prepare that policy. Disposal-operation records have an at-least-three-year rule, apart from other legal duties. The 30-day data-subject response clock is separate. Verify applicability and current Board decisions.
GDPR Article 5(1)(e) limits identifiable-data storage to the necessary purpose. Article 17 erasure also has exceptions. The regulation does not assign one number of years to every employee, log or customer record. Make documented, category-specific decisions for applicable sector/country duties and legal preservation.
Related primary references: KVKK · Silme, yok etme veya anonim hale getirme yönetmeliği ↗GDPR · Articles 5 and 17, official EUR-Lex text ↗
Legal holds, backups and cloud copies
A legal hold is not unlimited general archiving authority. Record the authorized request, matter ID, data scope, owner, access, review and release decision. Suspend deletion only within the relevant scope, not all copies indefinitely. Reassess normal retention/disposal when the basis ends.
Immutable backups may not allow immediate record-level deletion. Assess obligations, access restrictions, rotation expiry and reapplication of deletion lists after restore; “it stays in backup” does not close the obligation. For SaaS verify active data, recycle bins, versions, snapshots, subprocessors and key copies using contractual and technical evidence.
Related primary references: GDPR · Articles 5 and 17, official EUR-Lex text ↗
Deletion, sanitization, anonymization and destruction
File deletion or quick format does not prove safe media disposition. Choose clear, purge or destroy according to sensitivity, media, next use, control boundaries and verifiable methods. Assess re-linking for anonymization and encryption coverage, all key copies and prior plaintext copies for cryptographic erasure. NIST SP 800-88 Rev. 2, published September 2025, is the current program reference.
SSD/flash wear levelling and inaccessible areas defeat simplistic overwrite assumptions; degaussing is not a flash solution. Use methods supported for the media and verifiable by the organization. Do not report failed or uncertain media as successfully sanitized. Implementation belongs to authorized trained teams using approved procedures, not destructive commands run on an unidentified device.
| Media | Control question | Evidence |
|---|---|---|
| HDD / magnetic tape | Does the chosen method suit this media and reuse boundary? | Identity, method, tool result and validation |
| SSD / NVMe / flash | Are the supported sanitization/cryptographic method and scope validated? | Media support details, result and acceptance rationale |
| Mobile / printer / network device | Are storage, accounts, tokens and management records covered? | Reset/sanitization and access-revocation evidence |
| Cloud / SaaS / snapshot | Are copy, version, key and provider boundaries understood? | Scoped job result, provider evidence and exceptions |
| Paper / removable media | Is there custody evidence through secure collection and authorized destruction? | Batch, quantity/identity, witness and handover record |
Related primary references: NIST SP 800-88 Rev. 2 · September 2025 ↗NIST SP 800-88r2 · official FAQ ↗
How to establish custody and disposal evidence
Open a justified request, check retention/holds, obtain owner approval and quarantine the identified item. On handover record serial/asset ID, package/seal, time, sender/receiver and exceptions. Outsourcing does not remove accountability. A generic destruction certificate that does not reconcile to the serial list does not close this asset.
After execution retain method, operator, results, failed items, verification and acceptance. Distinguish checking execution from accepting the outcome. Reconcile CMDB relationships, inventory, custody, licensing, access and financial records. Manage e-waste duties separately: data sanitization does not prove environmental disposition, and a recycling receipt does not prove data sanitization.
Related primary references: NIST SP 800-88 Rev. 2 · September 2025 ↗NIST SP 800-88r2 · official FAQ ↗KVKK · Silme, yok etme veya anonim hale getirme yönetmeliği ↗
Assurance questions, measures and implementation
Sample in both directions: physical/discovered items to records and records to actual items/scope. Trace a critical service through dependencies, backup and deletion work. Follow a closed disposal record through approval, custody, outcome and record updates. A written policy is not evidence the control operated.
Begin with critical-service scope and a minimum data model; reconcile sources, approve retention schedules and test a small controlled return/disposal batch end to end. Surface ownerless critical assets, unvalidated relationships, overdue disposal, open holds and unmatched serials. Complete workpapers in the organization’s controlled environment; do not upload real personal data to this educational page.
Related primary references: CISA CRR · Asset Management resource guide ↗
Explore the reasoning behind your decision
Fictional learning situations, not an exam, score or compliance assessment. Choices and review checks last only on this open page and are not saved to your account.
An SSD was quick-formatted
A device will leave organizational control. The team calls a quick format secure disposal. What evidence is sufficient?
CMDB records are current but relationships missing
The server list is accurate, but the order API’s identity dependency is absent. Is recovery order demonstrated?
Workpapers for your organization
Complete the four blank Markdown workpapers in your controlled organizational environment. The full guide includes tables, all decision rationales and sources.
Full guide and explained examplesMarkdown · ENAsset-register workpaperConnect identity, ownership, protection and lifecycle in one record.CMDB relationship workpaperRecord relationship meaning/direction together with validation evidence.Retention and disposal scheduleDerive duration from applicable rationale and start event, not a sample number.Custody and disposal workpaperUnite identity, approval, custody, method and acceptance.
0 / 11 review checks selected on this page; these do not create operational evidence.
References and next work
References support the subject context; procedures and examples are original SecNet material. Verify legal applicability and current standard editions for actual use.
- CISA CRR · Asset Management resource guide ↗
Context for identifying and managing assets supporting a service.
- ServiceNow · CI relationships in the CMDB ↗
A vendor-primary example of CI relationships, not a product recommendation.
- NIST SP 800-88 Rev. 2 · September 2025 ↗
Sanitization-program reference; Rev. 1 is not the current edition.
- NIST SP 800-88r2 · official FAQ ↗
Method-selection and assurance context; the worked examples are original SecNet material.
- KVKK · Silme, yok etme veya anonim hale getirme yönetmeliği ↗
Articles 7, 11 and 12; distinguish each deadline’s purpose and scope.
- GDPR · Articles 5 and 17, official EUR-Lex text ↗
Storage limitation and erasure; does not prescribe one period for all records.