1. Archive / Destruction / Disposal
Over time, over the years, many files build up in the system.
Some files are up-to-date
Some are old and filling up hard disk space.
To prevent system from being clogged up with old files,
but we can’t delete them yet due to laws, policies.
Thus we need a process called “archive”.
Process, procedures are written for archive purposes.
Business invoice, payroll, receipts must be kept for some years. Hard copies, soft copies.
ICT managers, must make sure that storage media are safe. Are CD, DVD good for storage? Any risk?

2. Archive / Destruction / Disposal
After several years, archives files are often re-examined for permanent destroyed.
Paper files
- Paper files can be shredded or burnt.
- Not important / not confidential files can be recycle.
Electronic files
Must be treated as paper files. Can be erased, reformat .etc.
Some organisation use service from other company to destroy electronic data.
**** It is NOT up to employee to decide when files should be archived or destroyed.
The organisation will have a procedures document outlining
- What to be archived, when.
- When to destroy, how (type of shredder or confetti) .

3. Archive / Destruction / Disposal
Disposal of old equipment also is a challenge for some organisation.
Why?
Disposal of hard disks / backup media could cause
environmental hazard.
Information on hard disk can be recovered by some applications

4. Evaluation of data security management
Integrity of data (quality, accuracy, timeliness).
Security (data security is effective i.e. hw/sw ).
Ease of retrieval (can be restored, timeliness)
Currency of data / files (recent version is up-to-date)
Example: Openness & timeliness (information system must be easy to access when required).
ATO requests people account statement from Comms, ANZ .etc.
It is organisation obligation to keep information system safe.
It is ICT manager responsible to manage that data is safe.
It is ICT personnel must follow procedures/rules/policies to keep data safe.

5. Evaluation of data security management
Review Security management.
Identify risks.
Proposal for improvement where required.
Page N - 5