What it asks for. This control covers identifying, classifying, handling, retaining and disposing of data securely throughout its life. It expects a data management process, a data inventory and protective measures such as access restrictions and encryption matched to sensitivity.
In practice. The organisation defines a classification scheme, maps where sensitive data lives and flows, and sets retention periods tied to legal and business need. Encryption is applied on end user devices, removable media and in transit, access is limited on a need to know basis, and data loss prevention is used where risk justifies it. Auditors look for the data inventory, classification policy, retention schedule, encryption coverage reports and evidence of secure disposal.
Common gaps. Many organisations publish a classification policy but never apply labels or map data stores, especially in SaaS and file shares. Retention is rarely enforced, so old sensitive data accumulates and enlarges the impact of a breach.