{"catalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","download":{"releaseId":"sha256:1062311431000a1207b481fc5e4f0e6f8cd55b167e36e867d0ebb3c637136022","slug":"controls-data-retention-disposal","url":"/assets/agent_workflow-controls-data-retention-disposal-ca1727ac.dc717bd081710baf.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-data-retention-disposal","description":"Each cycle runs as a workflow instance attached to the existing data-retention-and-secure-disposal Control item in the control library (UC-DATA-09/UC-DATA-10) — enrich that Control with this run's evidence, never create a duplicate control. A decision-aware cycle covering expired-data identification, disposition approval, verifiable disposal, media sanitization, evidence assembly, and stakeholder reporting. In scope: identifying and disposing of data whose retention has expired across in-scope stores (databases, file shares, document repositories, email archives, backup sets, and physical media) governed by the approved retention schedule. Out of scope: authoring the retention schedule itself — it is consumed as a standing input (the retention Policy item and its attached schedule), not produced here — and any data under an active legal or audit hold, which is fenced off from disposal. No upstream workflow feeds this cycle; it is triggered by the disposal calendar, a storage threshold, a system decommission, or a data-subject erasure request. It produces a signed disposition list, a disposal evidence package (job logs, hash manifests, chain-of-custody records, and certificates of destruction), a cycle dashboard, and an approved cycle report mapped to ISO 27001 A.8.10/A.7.10, NIST SP 800-53 SI-12/MP-6, and GDPR Article 5(1)(e). Downstream it hands nothing to another workflow: open exceptions, deferrals, and accepted gaps carry forward as Issue items in the risk/issue register, and schedule-maintenance gaps are forwarded to the retention-schedule owner as a closure notice.","details":{"canonicalUrl":"https://evidenceflows.com/workflows/all/?w=controls-data-retention-disposal","capabilities":[],"controls":["UC-DATA-09","UC-DATA-10"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:1062311431000a1207b481fc5e4f0e6f8cd55b167e36e867d0ebb3c637136022","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-data-retention-disposal","standards":["iso-27001","nist-800-53","gdpr"],"teams":["it","privacy"]},"download":{"releaseId":"sha256:1062311431000a1207b481fc5e4f0e6f8cd55b167e36e867d0ebb3c637136022"},"history":{"digest":"ebe201f5b1eb0ef765065aa2d7284ed44ae4f257defe85d243dc73daee03e531","firstSeenAt":"2026-09-17T22:28:00Z","firstSeenRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","updatedAt":"2026-10-04T21:48:26Z","updatedRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4"},"id":"wf:C21","mapUrl":"https://evidenceflows.com/?v=1&node=wf%3AC21","slug":"controls-data-retention-disposal","sourceIds":["iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"Data Retention & Secure Disposal","type":"workflow"},"relationships":[{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:8e2c4a918abd68a7e5dd21a492e897b162ffb0277fc940b1ae437be09b6c1fbe","properties":{},"sourceDetailPath":"/data/v1/records/wf-c21-3ea9108a.json","sourceId":"wf:C21","targetDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","targetId":"uc:UC-DATA-09","type":"operates"},{"expectedCatalogRevision":"791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4","id":"rel:a32353f2867dfd51f6f075d30ff40680a5957c5ccdad6f1adf9cca342b2d9f6f","properties":{},"sourceDetailPath":"/data/v1/records/wf-c21-3ea9108a.json","sourceId":"wf:C21","targetDetailPath":"/data/v1/records/uc-uc-data-10-e7ad28aa.json","targetId":"uc:UC-DATA-10","type":"operates"}],"schemaVersion":1}