12. Data handling, retention, and storage

Question 1

Data handling, retention, and storage

Data Handling

Answer 1

1. Only trusted individuals should handle data
2. Policies should be in place - how, where, when, why
3. Logs should show the above metrics

• Administrative control
• Feeds back to the “need to know” Who accessed the data, did they have a good reason to do so?

Question 2

Data handling, retention, and storage

Data Storage

Answer 2

1. Where is sensitive data kept
2. Secure, climate controlled facility, geographically distance location

• When there is a disaster, the tapes are safe from

Question 3

Data handling, retention, and storage

MTD

Answer 3

Maximum Tolerable Downtime

• If MTD is 4 hours, it takes 2 hours to restore but 3 hours for backup company to deliver the tapes, this is past the MTD
• Disaster Recovery Plan factors in. Testing, walk through, realisations of possible problems

Question 4

Data handling, retention, and storage

Backup Company - Collecting tapes

Answer 4

Reliable & Bonded

• Whomever collects must understand the liability
• Insurance must be in place if the tapes are lost
• Documented list of people whom can collect the tapes

Question 5

Data handling, retention, and storage

Data Retention

Answer 5

Should not be kept beyond;
1. period of usefulness
2. legal requirements

• HIPAA or PCI_DSS may require certain retention - 1, 3 ,7 years or indefinitely
• Each industry has its own regulations

Question 6

Data handling, retention, and storage

Credit Card Processing

Answer 6

Log of Transaction
NOT actual transaction

• If your business accepts credit cards but are not a credit card processor
• Once data is handed off to credit card processor, business needs to get rid of it