{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Data Protection & Privacy","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-09","description":"Maintain an approved retention schedule for personal and confidential information tied to documented legal and business requirements, and retain data no longer than the schedule permits. When retention ends, delete or irreversibly destroy the information wherever it resides, including in external services, using methods that prevent reconstruction, and record disposal actions as evidence.","details":{"control_category":"administrative","control_type":"preventive","domain":"Data Protection & Privacy","guidance":[],"members":[{"control_id":"SI-12","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"P4.2","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"P4.3","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"C1.2","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"A.8.10","coverage":"full","framework":"iso-27001","relationship":"superset_of"}],"statement":"Maintain an approved retention schedule for personal and confidential information tied to documented legal and business requirements, and retain data no longer than the schedule permits. When retention ends, delete or irreversibly destroy the information wherever it resides, including in external services, using methods that prevent reconstruction, and record disposal actions as evidence.","title":"Retain personal and confidential data per schedule, then destroy it","unified_id":"UC-DATA-09"},"id":"uc:UC-DATA-09","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-09","sourceIds":["iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"UC-DATA-09 — Retain personal and confidential data per schedule, then destroy it","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0f9faaab8d2b58613fbda61eff2620de35a732db38981a8c545f75bc86d69534","properties":{},"sourceDetailPath":"/data/v1/records/wf-d21-5f7f687f.json","sourceId":"wf:D21","targetDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","targetId":"uc:UC-DATA-09","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1dac742b744aa5f113abc6f1763362dfe41de89aa549038f21b60fa196d1427f","properties":{"rationale":"Destroying data past its retention shrinks the volume of data exposable in any breach.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2e2b50c86f8b2218c14fb4e9569a5c8a0507a11726b723c80dff2fd945514676","properties":{"control_id":"A.8.10","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-10-8e3feb8b.json","targetId":"ctrl:iso-27001:A.8.10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:373c45887513ad94fe7fcd0efc5cb6d11335eccf3f88f46255d388f9c6441dfc","properties":{"rationale":"An approved retention schedule with timely, irreversible destruction directly prevents both unlawful over-retention and premature deletion.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/risk-data-retention-noncompliance-ec7b8dbc.json","targetId":"risk:data-retention-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3acd682ded27c4cd1e08c07c21dc286da54ee2b3ddaa76e98e620e9c7c257af0","properties":{"rationale":"Irreversible destruction preventing reconstruction wherever data resides, including external services, directly eliminates residual data on disposed/reused storage.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/risk-data-residual-media-disposal-92de3d1d.json","targetId":"risk:data-residual-media-disposal","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3c368e8d5cd133cfa68fd95b63f28cd1e3ee68b5a497a9edbc7359d9a8bec0bb","properties":{"control_id":"P4.3","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/ctrl-soc2-p4-3-e624ef20.json","targetId":"ctrl:soc2:P4.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:77b0a3797cd99e1ef3591fc31a42e01b92981d8bf5cb7ce5166355a65af4b2ed","properties":{"control_id":"SI-12","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-si-12-9c86a747.json","targetId":"ctrl:nist-800-53:SI-12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8e2c4a918abd68a7e5dd21a492e897b162ffb0277fc940b1ae437be09b6c1fbe","properties":{},"sourceDetailPath":"/data/v1/records/wf-c21-3ea9108a.json","sourceId":"wf:C21","targetDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","targetId":"uc:UC-DATA-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:981c400816049b849cc0babc2e238f4d180f187b7f170d0ad03bf744d4d27a5d","properties":{"control_id":"C1.2","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/ctrl-soc2-c1-2-e6a223bc.json","targetId":"ctrl:soc2:C1.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a3bc9579d4d8f254bd20e0588f05bebdc4286337dd5cbc8aa5b11f0ba022e974","properties":{"control_id":"P4.2","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/ctrl-soc2-p4-2-d4d26585.json","targetId":"ctrl:soc2:P4.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bc5be79e751895a0e16b9132c0ca7a3702ac8e2ba14989d41e094fdf45193aeb","properties":{},"sourceDetailPath":"/data/v1/records/wf-d22-f1c724b8.json","sourceId":"wf:D22","targetDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","targetId":"uc:UC-DATA-09","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bda701e58a4f91873c74878ba1733dc4cc012375dd60a495796414333c42df17","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","targetId":"uc:UC-DATA-09","type":"tests"}],"schemaVersion":1}