Asset, Data & Architecture
Retention periods, disposal methods, and confidentiality handling rules are approved and maintained by data category.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Each important data category has an approved retention period, disposal method, confidentiality handling rule, and accountable owner, with legal, customer, security, and operational considerations documented where relevant.
First SOC 2 program
Create a practical schedule for customer content, account data, billing records, logs, support material, backups, personnel data, and security evidence. Set a defensible default where a category has no special need, and confirm that the product and storage platforms can support the decision.
As the company scales
Link the approved schedule to data-catalog entries and system lifecycle settings. Automate deletion where safe, manage legal or investigation holds separately, and track conflicts between approved periods and actual product, backup, analytics, or vendor behavior.
Use the data inventory and flows to identify important categories and every primary, replica, backup, analytics, support, and vendor location where they reside.
You should end up with: A category-to-system map with owners and locations.
For each category, record the business, legal, customer, security, privacy, or audit reason for the chosen period and identify conflicting obligations for review.
You should end up with: A retention schedule with period, rationale, owner, and approver.
Specify deletion, media sanitization, cryptographic erasure, account closure, or another suitable method, plus confidentiality rules during the retention period.
You should end up with: A disposal and handling matrix by data category and storage type.
Obtain review from data, engineering, security, privacy, and legal owners as applicable, then give system owners the decisions they must configure.
You should end up with: An approved, versioned schedule and owner communication record.
Record the database jobs, object lifecycle rules, log periods, backup expiry, SaaS settings, and manual procedures that implement each decision.
You should end up with: A schedule-to-configuration mapping with gaps and remediation owners.
Revisit decisions for new data uses, customer commitments, legal holds, and system changes, and document temporary departures with expiration dates.
You should end up with: Dated review records and an exception or hold register.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Shows the approved period, triggering event, rationale, owner, and review status for each important data category.
Include this context
data category
Include this context
retention period and start event
Include this context
business, legal, customer, security, or privacy rationale
Include this context
owner
Include this context
approver
Include this context
effective and review dates
Weak evidence to avoid
A policy sentence saying records are kept as long as necessary, without categories, periods, start events, owners, or approvals.
Confirm what the record proves
Shows that the retention and confidentiality decisions cover actual data categories across primary, replica, backup, log, analytics, support, and vendor locations.
Include this context
data category
Include this context
systems and storage locations
Include this context
classification
Include this context
processing purpose
Include this context
owner
Include this context
schedule reference
Weak evidence to avoid
A list of broad labels such as customer data that does not identify repositories, owners, copies, or the applicable schedule entry.
Confirm what the record proves
Shows the approved deletion, expiry, sanitization, erasure, or other disposal action for each data category and storage technology.
Include this context
data category
Include this context
storage type or system
Include this context
disposal method
Include this context
expected completion or backup expiry
Include this context
verification method
Include this context
exception or hold path
Weak evidence to avoid
A row saying secure deletion for all data without distinguishing databases, backups, SaaS, devices, media, or how completion is verified.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Shows that accountable data, engineering, security, privacy, business, or legal reviewers considered and authorized the retention and handling decisions relevant to them.
Include this context
schedule or decision version
Include this context
review scope
Include this context
reviewer and role
Include this context
decision
Include this context
conditions or conflicts
Include this context
approval date
Weak evidence to avoid
An undated document marked approved without named reviewers, decision scope, version, or unresolved conflicts.
Type 1
The approved retention schedule, data-category inventory, disposal mapping, live system configuration mapping, and all open holds or exceptions on the examination date.
Type 2
Every new or revised data-category retention, confidentiality-handling, disposal, hold, or exception decision during the review period, plus each quarterly review of production or customer-impacting categories and annual review of supporting categories due in the period.
Map every category and location in the current data inventory to one approved schedule and disposal row, then compare database, object-storage, log, backup, analytics, and SaaS lifecycle settings with those decisions; investigate missing mappings, period conflicts, and expired holds.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Each important data category has an approved retention period, disposal method, confidentiality handling rule, and accountable owner, with legal, customer, security, and operational considerations documented where relevant.
Compare the documented owner with the intended role (Engineering / Infrastructure / Data Owner), then compare dated records with the stated cadence: Quarterly for production/customer-impacting; annually for supporting assets.
Map every category and location in the current data inventory to one approved schedule and disposal row, then compare database, object-storage, log, backup, analytics, and SaaS lifecycle settings with those decisions; investigate missing mappings, period conflicts, and expired holds.
The approved retention schedule, data-category inventory, disposal mapping, live system configuration mapping, and all open holds or exceptions on the examination date.
Every new or revised data-category retention, confidentiality-handling, disposal, hold, or exception decision during the review period, plus each quarterly review of production or customer-impacting categories and annual review of supporting categories due in the period.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Shows the approved period, triggering event, rationale, owner, and review status for each important data category.
For each selected record, confirm it demonstrates Shows that the retention and confidentiality decisions cover actual data categories across primary, replica, backup, log, analytics, support, and vendor locations.
For each selected record, confirm it demonstrates Shows the approved deletion, expiry, sanitization, erasure, or other disposal action for each data category and storage technology.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Shows that accountable data, engineering, security, privacy, business, or legal reviewers considered and authorized the retention and handling decisions relevant to them.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.