3.3. Data Lifecycle Management
💡 First Principle: Data has a lifecycle — it is created, used, stored, retained, and ultimately destroyed. Security obligations attach to data throughout that entire lifecycle, not just while it's being actively used. Failing to manage any stage creates legal, regulatory, or security exposure.
The data lifecycle is the operational context for most Domain 2 controls. Classification determines what controls apply; the lifecycle determines when they apply and what happens at each transition. The most frequently missed lifecycle stage is destruction — organizations invest heavily in protecting data at rest and in transit but often fail to destroy it securely when the retention period ends.
Why this matters: Data destruction methods are heavily tested on the CISSP — specifically, which method is appropriate for which media type. Wrong method = data remanence = potential breach long after the data was "deleted."
⚠️ Common Misconception: "Deleting a file removes the data." Standard deletion removes the directory entry pointing to the data — the data itself remains on the storage medium until overwritten. This is data remanence. Even formatting a drive doesn't reliably erase data on modern SSDs. The correct response is media-type-appropriate secure destruction.
