IT Data destruction audit proposal Ryan Boyce, sheena Thomas, candace nelson, Jason wulf, folake stella alabede

CRS InfoSec Solution’s Proposed Objective and Scope Ensure effectiveness of the IT Data Destruction Policy and assess the sufficiency of associated controls and procedures Appropriate mechanisms to enforce and monitor adherence Compliance with Policy

Assets Subject to Audit Hard Drives RAM Removable Storage Devices

Risk 1: The Wrong Hardware is Identified for Destruction Preventive Controls Asset Inventory Management Tool Asset Tagging (e.g. Barcodes) Help Desk Ticketing Tool Detective Control Physical Inventory

Risk 2: Failure to Adequately Wipe Hardware Preventive Control Help Desk Ticketing Tool Detective Control Independent Sampling Mitigating Control Physical Destruction

Risk 3: Wrong Hardware Transferred to Vendor Preventive Controls Help Desk Ticketing Tool Service Level Agreement Detective Controls IT Oversight Certificate of Destruction

Risk 4: Vendor Fails to Adequately Destroy Equipment Preventive Controls On-Site Destruction Visual Verification Certificate of Destruction Service Level Agreement   Detective Controls Management Oversight

Other Controls to be Considered: Segregation of Duties Monitoring Independent Oversight of IT Physical Inventories Employee Training Independent Audits of Systems Asset Inventory Management Tool Help Desk Ticketing Tool Contract Audits (e.g. Compliance with SLA’s)

Wrap Up Global leader in IT GR&C consulting > 15 years experience Provides leading edge consulting services CISA, CISSP and COBIT certified auditors

Questions??