Domain 2 follows information through its lifecycle, from the moment it is created or collected to the day the media that holds it is destroyed. It covers classification, data roles, handling and retention, the states data can be in, and sanitization.
Case Study: The "SecureVault" Hard Drive Disposal Fiasco
SecureVault is a managed service provider that runs the ATM networks of several regional credit unions. In late 2024 it started a hardware refresh, replacing the magnetic hard drives in 500 legacy ATMs with SSDs. The drives held the machines' local transaction logs. On the active fleet, data in transit was encrypted; data at rest on these older units was not. There was no full-disk encryption, and the drives carried no label saying what was on them. SecureVault's own policy classified the data as Restricted.
To cut the cost of the refresh, the operations manager hired a local, uncertified recycler, Discount-Recycle, to take the old drives. The drives were "wiped" with the operating system's quick format, which deletes the file allocation entries and leaves every sector of data on the platters. No transfer document changed hands. The recycler, seeing 500 working drives and no paperwork, resold them.
Two weeks later an investigative journalist bought a bulk lot of used drives from an online auction site for $50. She connected one to a forensic write-blocker. It was fully functional and held the unencrypted transaction logs of more than 15,000 banking customers: names, primary account numbers, and some encrypted PIN blocks.
The white paper lists full-disk encryption on the terminal drive among the standard logical controls for exactly this reason: an ATM's hard drive leaves the machine at end of life, and sometimes before. It also notes that malware which steals card data often parks it on the local disk for later retrieval, so the drive is a target while the ATM is still in service.
One organization each, three to six questions apiece in the printed examination. Nothing here gives an answer away — the scenario is what the question hands you before it asks.
SecureVault runs ATM processing for regional banks. It retired 500 legacy hard drives holding unencrypted cardholder transaction logs, quick-formatted them, and handed them to a recycler found through a web search. The recycler resold them intact. A journalist bought one, attached a forensic write-blocker, and recovered 15,000 complete customer records: the file allocation table was empty and every record was still there. A data steward is now assigning a classification to those transaction logs, which carry names, card numbers and encrypted PIN blocks, and the review is mapping the failure against the asset lifecycle.
SecureVault · ATM processing bureau
SecureVault is drafting a corrected disposal procedure for magnetic drives that hold Restricted cardholder data and will leave the company's control. Its IT manager still insists the previous technicians did their job: every sensitive file was deleted and the recycle bin emptied before the drives left the building, yet complete customer records were later recovered from them. A dispute is also open with the recycler, which says it received 450 drives while operations insists 500 were shipped, and neither side can produce a signed record of what changed hands. Someone must own the classification level itself.
SecureVault · operations and compliance
Brightwater Data Services replaced the magnetic drives in its card processing estate with solid-state drives, but its disposal procedure still names degaussing as the approved sanitization method and nobody has revisited it. The first solid-state retirements fall due next quarter. An engineer has warned the steering group that these drives pose a different problem from the ones the procedure was written for. The company is also introducing a physical labeling standard for storage media, and must decide which role actually performs the day-to-day protection of stored records: encryption at rest, sanitization, backups.
Brightwater Data Services · card processing
Anvil Payments is moving its archived transaction logs to a multitenant cloud service and has realized it can never physically shred the provider's disks, which are shared with other customers. The architecture team is working out what end-of-life assurance it can actually offer. The same question came up about the company's own laptops before the migration, where full disk encryption was deployed but nobody documented why. A red-team exercise has separately shown that memory-scraping malware could read plaintext card numbers on a scoring server while records encrypted on the wire and on disk were being processed.
Anvil Payments · cloud archive migration
SecureVault has just rebuilt by hand the asset inventory it discovered it never had, and the asset manager warns it will drift immediately: hundreds of drives and devices enter or leave service across the estate in any month. Management wants the inventory to keep matching reality as that churn continues, and wants to know what each record must carry to support accountability at all. The privacy team is separately triaging recovered data to establish breach-notification scope, and a control baseline is being written for every machine.
SecureVault · asset management
Classification has to travel with the asset. A Restricted label on a policy page protects nothing; the label belongs on the drive, in the asset register, and in the refresh project plan as a disposal step the security team signs off.
Sanitization follows NIST SP 800-88. For magnetic drives leaving the organization's custody that means purge (degaussing) or physical destruction, with a certificate of destruction from a NAID-certified vendor and a chain-of-custody record listing serial numbers. Quick format is not on the list. Note the SSDs going in: degaussing does nothing to flash, so their end of life will need cryptographic erase or shredding, which is one more reason to encrypt them from day one.
The logs themselves were the other problem. PCI DSS requires the PAN to be unreadable wherever it is stored, and forbids keeping sensitive authentication data after authorization. A log that holds full account numbers in clear text is a finding before any drive goes missing. Retention should have been set by the data owner, and the logs on a decommissioned terminal should have been purged before the drive was pulled.
SecureVault's contract with the credit unions made it a custodian. The credit unions, as data owners, carried the notification duty to 15,000 members and the regulatory exposure, and their first call was to the MSP that had saved money on recycling. The refresh project restarted with encryption switched on and a destruction vendor under contract.
Expect questions on the data roles (owner, custodian, processor, and who is accountable when the custodian errs), the difference between clearing, purging and destroying, which method fits which media, why a Restricted classification requires labelled media and documented handling, and how retention policy limits what a lost drive can expose.
The organizations in this scenario are composites. The controls are documented in: