{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:f6701b905bc9cb9478c91fc668ae944d10bfa6a8ab6b18eb919a0be2ef47fa5e","slug":"controls-data-retention-disposal","url":"/assets/agent_workflow-controls-data-retention-disposal-ca1727ac.87f308637bcbe0af.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-data-retention-disposal","description":"Each cycle runs as a workflow instance attached to the existing data-retention-and-secure-disposal Control item in the control library (UC-DATA-09/UC-DATA-10) — enrich that Control with this run's evidence, never create a duplicate control. A decision-aware cycle covering expired-data identification, disposition approval, verifiable disposal, media sanitization, evidence assembly, and stakeholder reporting. In scope: identifying and disposing of data whose retention has expired across in-scope stores (databases, file shares, document repositories, email archives, backup sets, and physical media) governed by the approved retention schedule. Out of scope: authoring the retention schedule itself — it is consumed as a standing input (the retention Policy item and its attached schedule), not produced here — and any data under an active legal or audit hold, which is fenced off from disposal. No upstream workflow feeds this cycle; it is triggered by the disposal calendar, a storage threshold, a system decommission, or a data-subject erasure request. It produces a signed disposition list, a disposal evidence package (job logs, hash manifests, chain-of-custody records, and certificates of destruction), a cycle dashboard, and an approved cycle report mapped to ISO 27001 A.8.10/A.7.10, NIST SP 800-53 SI-12/MP-6, and GDPR Article 5(1)(e). Downstream it hands nothing to another workflow: open exceptions, deferrals, and accepted gaps carry forward as Issue items in the risk/issue register, and schedule-maintenance gaps are forwarded to the retention-schedule owner as a closure notice.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-data-retention-disposal","capabilities":[],"controls":["UC-DATA-09","UC-DATA-10"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:f6701b905bc9cb9478c91fc668ae944d10bfa6a8ab6b18eb919a0be2ef47fa5e","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-data-retention-disposal","standards":["iso-27001","nist-800-53","gdpr"],"teams":["it","privacy"]},"id":"wf:C21","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC21","slug":"controls-data-retention-disposal","sourceIds":["iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"Data Retention & Secure Disposal","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8e2c4a918abd68a7e5dd21a492e897b162ffb0277fc940b1ae437be09b6c1fbe","properties":{},"sourceDetailPath":"/data/v1/records/wf-c21-3ea9108a.json","sourceId":"wf:C21","targetDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","targetId":"uc:UC-DATA-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a32353f2867dfd51f6f075d30ff40680a5957c5ccdad6f1adf9cca342b2d9f6f","properties":{},"sourceDetailPath":"/data/v1/records/wf-c21-3ea9108a.json","sourceId":"wf:C21","targetDetailPath":"/data/v1/records/uc-uc-data-10-e7ad28aa.json","targetId":"uc:UC-DATA-10","type":"operates"}],"schemaVersion":1}