Capstone: an asset classification and handling program

This final lesson brings the whole of Domain 2 together by designing an asset security program for a fictional mid-sized organization. You will build an inventory approach, choose a classification scheme, assign roles, write handling rules, plan provisioning and end-of-support management, map the data life cycle, select protection methods, set retention and destruction rules, address privacy, and choose controls and evidence for compliance. The scenario is deliberately ordinary, because most real asset security work happens in organizations like this one rather than in intelligence agencies or global banks. Work through each step yourself before reading the suggested answer.

The scenario

Northbridge Home Care is a home health care company with 650 employees, headquartered in Ontario, with offices in Ontario and British Columbia. Nurses and personal support workers visit about 9,000 clients a year, recording care notes on tablets. The company also holds employee files, payroll, contracts with provincial health agencies, and a marketing list. It uses a software-as-a-service electronic health record, a cloud office suite, an on-premises file server, a payroll provider and a document shredding vendor. It is a health information custodian under Ontario's Personal Health Information Protection Act and subject to PIPEDA and British Columbia's Personal Information Protection Act for other personal information. A recent audit found unmanaged tablets, spreadsheets of client data on staff laptops, no retention schedule and inconsistent disposal of old devices.

Leadership has asked the security manager to design an asset security program that fixes the audit findings, supports compliance and does not slow down care delivery. The rest of this lesson follows the order of the domain.

Step 1: inventory and ownership

The first task is to know what Northbridge has. The security manager combines procurement records, the mobile device management console, network discovery, the cloud office suite's admin reports, the EHR vendor's user list and a data discovery scan of the file server and laptops. Each asset gets an owner: the director of clinical operations owns care records and tablets used for care; the human resources director owns employee files; the chief financial officer owns payroll and billing; the marketing manager owns the marketing list; the IT manager is system owner for the file server and the office suite, and custodian for most infrastructure. The EHR and payroll vendors are processors and custodians for their services under contract.

Step 2: classification scheme

Northbridge adopts a four-level scheme: public, internal, confidential and restricted. Health information about clients and large sets of employee personal information are restricted, because compromise would cause serious harm to individuals and trigger legal obligations. Contracts, payroll summaries and smaller personal data sets are confidential. Policies and the staff directory are internal; the website and brochures are public. Owners apply the scheme to their data sets, and the cloud office suite is configured with matching sensitivity labels, with internal as the default for new documents and automatic recommendation of restricted when content looks like health information.

Step 3: handling rules

The security manager drafts a one-page handling matrix with the owners. Restricted information may be stored only in the EHR, the HR system and designated restricted sites in the office suite, never on laptops, personal devices or removable media. It may be emailed internally only with encryption and outside the company only through the EHR's secure messaging or the secure file portal with owner approval. Printing of restricted information is limited to clinical forms in offices with secure print release; field staff do not print client records at home. Clean desk and clear screen rules apply in offices, and tablets lock after two minutes. Confidential information follows the standard rules from lesson 4.

To deal with the spreadsheets on laptops, the clinical operations director and IT build a reporting environment inside the EHR's analytics module, so managers can get the reports they used to build by hand, and endpoint DLP is set to warn, then block, saving files that match health information patterns to local drives.

Step 4: provisioning and end of support

All new tablets and laptops must be enrolled in device management and receive the hardened baseline before issue; unenrolled devices are blocked from the corporate network and from the EHR through conditional access. New staff receive access through role-based groups approved by owners, and departures trigger same-day removal of access and return of devices. The inventory now records support end dates: 60 older tablets lose operating system support in nine months, so they are scheduled for replacement within six months, with the remainder restricted to non-clinical use until replaced. The on-premises file server's operating system loses support in 18 months; the plan is to migrate its contents to the cloud office suite and decommission it.

Step 5: data life cycle and protection methods

The team maps each restricted data set through its life cycle. For care records, collection follows clinical need and is captured directly in the EHR on managed tablets; data is stored in the EHR vendor's domestic region, with backups contractually limited to the same country; use is limited by role, logged and reviewed monthly for inappropriate access; sharing with health agencies uses approved interfaces; and archived records follow the retention schedule. Protection methods are chosen to fit: full-disk encryption and remote wipe on tablets and laptops, TLS 1.2 or higher for all connections, customer-managed keys for the restricted sites in the office suite, dynamic masking of identifiers in the EHR analytics module for managers who do not need names, and pseudonymized extracts for the quality improvement team.

Step 6: retention and destruction

Northbridge's legal counsel and the privacy officer draft a retention schedule. Client health records are kept for the period required by Ontario's health and professional college standards, with a longer period for clients who were minors. Tax and payroll records are kept for at least six years after the end of the relevant tax year. Employee files are kept three years after departure unless a claim is pending. The marketing list is purged of contacts with no activity for two years. Legal holds, issued by counsel, suspend deletion for any data relevant to complaints or litigation.

Destruction follows the media and classification. Retired tablets and laptops are purged with crypto-erase or the drive's sanitize command, verified and recorded with serial numbers; devices that fail verification are destroyed. The file server's disks are destroyed after the migration is validated and the retention schedule applied. Paper from offices goes to the shredding vendor, which provides certificates of destruction and is contracted to meet security requirements. Every disposal updates the inventory.

Step 7: privacy

The privacy officer conducts a privacy impact assessment for the move to the cloud office suite and for any new client-facing application, and reviews the EHR vendor's processing agreement. Because Northbridge has an office in British Columbia, its BC personal information other than health information falls under BC's Personal Information Protection Act. Client access and correction requests under PHIPA are routed to the privacy officer, who can now find every copy of a client's information using the data map. Breaches involving personal health information are reported to the Information and Privacy Commissioner of Ontario and the affected individuals as PHIPA requires.

Step 8: controls, evidence and metrics

The security manager chooses the CIS Critical Security Controls Implementation Group 2 as the baseline, mapped to the applicable health privacy requirements, scopes out controls for technologies Northbridge does not use, inherits physical controls from the cloud providers, and tailors parameters such as screen lock times and log retention. Evidence is collected quarterly: device enrolment rates, access recertifications by owners, DLP alerts and outcomes, sanitization certificates, retention disposals and training completion. These metrics go to leadership in a short dashboard.

Lessons from the capstone

The capstone shows how the domain fits together. Inventory and ownership came first, because every later decision depended on knowing what existed and who decided. Classification gave the handling rules their structure. Handling rules worked because tools enforced them and because a better reporting option replaced the risky spreadsheets. Provisioning closed the door on unmanaged devices, and end-of-support planning kept old systems from drifting. The life cycle view caught copies and locations that might otherwise be missed. Protection methods were chosen to fit specific needs rather than applied uniformly. Retention and destruction reduced the data that could ever be breached. Privacy shaped what data was held and how individuals' rights were met. And evidence showed leadership and regulators that the program worked.

On the exam, many Domain 2 questions are miniature versions of this capstone. Identify the asset, its owner and its classification; apply the handling, retention and destruction rules that follow; choose protection methods that fit what must be preserved; and remember that accountability stays with the owner, even when custodians and processors do the work.