During an onsite audit, an assessor inspected an organization’s asset decommission practice.

Solid State Drives (SSD) were degaussed along with hard drives.

The Non-Disclosure Agreement (NDA) between the organization and its data disposal service was more than 3 years old.

Hard drives from older assets replaced defective hard drives from current assets of similar classification levels.

Data classifications were not clearly identified.