What it asks for. This control expects information stored in information systems, devices or any other storage media to be deleted when no longer required. Its purpose is to avoid unnecessary exposure of sensitive information and to meet legal, regulatory and contractual requirements for deletion.
In practice. Good practice means defining retention periods, deleting information when they expire, and using secure deletion methods suited to the media, including verified destruction by service providers. Deletion requirements are agreed with cloud and other suppliers. Auditors look for retention rules, deletion records, certificates of destruction and contract terms covering deletion.
Common gaps. Common gaps are keeping everything indefinitely, no deletion in backups or SaaS services and decommissioned devices disposed of without verified wiping. Data held in test environments, exports and personal copies is also frequently forgotten when retention periods end.