Now, here again, you see the data lifecycle. But in this particular slide, we're going to talk about different items. First, we have to be certain that the confidentiality, integrity, and availability protections are fully functional, as appropriate, in each one of the six phases. For example, during generation, this would mean that the generation or acquisition process would include that the controls are always geared towards baseline authentication, classification, and protection commensurate with the data type and value, which leads to an accurate classification and categorization of the data object, and therefore, places it under the appropriate controls for such data.

In the portions of the cycle regarding retention, we need to be sure that we identify data and its transient or persistent characteristics, so that we have these attributes clearly defined and implemented to make sure that the governance practices are in place, and that those responsible act in compliance by enforcing policy. When we reach disposal, we need to be sure that the certain data types that need to be retained, or do not need to be retained based on regulatory requirements, that they, and when other types lose their value and impact, there are other types that still retain the potential liabilities and associated with some form of uncontrolled unwanted disclosure. This means that we need to be sure we recognize that at no time does individually identifiable data ever cease to be a breach for as long as it's in our possession and available in a human-readable form. Thus it is that we need to find assured disposal practices, those that truly and irrecoverably render the data into a nonhuman readable, nonhuman recoverable form to address those concerns and make certain that these data objects cannot be recovered by anyone by any means.