Controls

Storage hardware holding regulated records is wiped or shredded by an approved vendor before it leaves company custody,…

A documented retention and destruction schedule governs how long customer and internal records are kept in each system…

Every host, container image and managed database serving production is recorded in the asset register with an accountable team.

A signed continuity and recovery plan defines escalation paths, communication owners and target restore windows per service,…

The continuity plan is rehearsed at least annually with a written debrief, and findings are tracked to closure by the owning team.