SANS Assessment of Student Learning Plan (ASLP) Security Awareness Training

What should you do with sensitive data that is no longer needed?

1. Store it indefinitely

2. Share it with colleagues

3. Securely dispose of it

4. Leave it on your device

The correct answer is: Securely dispose of it

Sensitive data that is no longer needed should be securely disposed of to protect both the organization's integrity and the privacy of individuals associated with that data. Secure disposal methods ensure that the information cannot be recovered or accessed by unauthorized individuals, thereby reducing the risk of data breaches or information leaks. When sensitive data is retained without a valid need, it poses a potential risk. Storing it indefinitely can lead to vulnerabilities, as the more data that is kept over time, the higher the chances that it could be improperly accessed or leaked. Sharing sensitive data with colleagues who do not need it undermines privacy controls and creates unnecessary risks within the organization. Leaving data on your device, especially if that device may be lost or compromised, further puts the information at risk. Therefore, securely disposing of sensitive data when it is no longer necessary is a best practice in maintaining data security and compliance with data protection regulations.