Does your organization have a documented process for the timely return and secure disposal of assets containing organizational data?

This question assesses whether your organization has formal procedures to ensure that all company assets (laptops, mobile devices, storage media, etc.) containing sensitive data are either returned or properly destroyed when no longer needed or when employees leave. Without proper asset return and disposal processes, organizational data may remain accessible to unauthorized individuals, potentially leading to data breaches or compliance violations. Evidence could include a documented asset return/disposal policy, exit checklists for departing employees, certificates of destruction from approved vendors, asset disposal logs, or records of media sanitization that comply with standards such as NIST SP 800-88.