1. IT Data destruction audit proposal
Ryan Boyce, sheena Thomas, candace nelson, Jason wulf, folake stella alabede

2. CRS InfoSec Solution’s Proposed Objective and Scope
Ensure effectiveness of the IT Data Destruction Policy and assess the sufficiency of associated controls and procedures
Appropriate mechanisms to enforce and monitor adherence
Compliance with Policy

3. Assets Subject to Audit
Hard Drives
RAM
Removable Storage Devices

4. Risk 1: The Wrong Hardware is Identified for Destruction
Preventive Controls
Asset Inventory Management Tool
Asset Tagging (e.g. Barcodes)
Help Desk Ticketing Tool
Detective Control
Physical Inventory

5. Risk 2: Failure to Adequately Wipe Hardware
Preventive Control
Help Desk Ticketing Tool
Detective Control
Independent Sampling
Mitigating Control
Physical Destruction

6. Risk 3: Wrong Hardware Transferred to Vendor
Preventive Controls
Help Desk Ticketing Tool
Service Level Agreement
Detective Controls
IT Oversight
Certificate of Destruction

7. Risk 4: Vendor Fails to Adequately Destroy Equipment
Preventive Controls
On-Site Destruction
Visual Verification
Certificate of Destruction
Service Level Agreement
Detective Controls
Management Oversight

8. Other Controls to be Considered:
Segregation of Duties
Monitoring
Independent Oversight of IT Physical Inventories
Employee Training
Independent Audits of Systems
Asset Inventory Management Tool
Help Desk Ticketing Tool
Contract Audits (e.g. Compliance with SLA’s)

9. Wrap Up Global leader in IT GR&C consulting > 15 years experience
Provides leading edge consulting services
CISA, CISSP and COBIT certified auditors

10. Questions??