AI Control Library / CF-05: Data Governance & Privacy
Designation: Supplemental | Control types represented: Operational and Technical
Control requirement
Destroy AI cryptographic keys only under authorized lifecycle or incident decisions, accounting for protected assets, retained data, copies and recovery material. Verify the scope and irreversibility of the intended destruction.
Why this matters
Premature destruction can make required records unrecoverable, while partial destruction can leave information accessible. Disabling a key or scheduling deletion is not necessarily completed destruction.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Keys retired after retention ends or destroyed under approved sanitization or security decisions, including managed-service and archived copies.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The data and key owners authorize destruction with relevant records or legal input; key custodians execute and verify it.
Implementation guidance
- Inventory dependent assets, retention duties, preservation requirements and key copies, distinguishing what must remain recoverable.
- Approve destruction scope and method with appropriate separation and safeguards against accidental irreversible action.
- Execute through supported secure mechanisms, addressing backups, archives and recoverable copies as required by the objective.
- Verify completion and service evidence, recording limitations and the effects on retained data without retaining secret material in the audit record.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Inspect a destruction decision | Dependencies and required preservation were reviewed before execution. |
| Review managed-service deletion | Evidence distinguishes scheduling, disablement and completed destruction. |
| Test the claimed protection effect | Required key copies and access paths support the conclusion. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Destruction authorization and scope
- Dependency and retention review
- Execution and completion evidence
- Copy and recovery disposition records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate uncertain destruction, unexpected dependency or accidental deletion to security and service owners. Pause remaining destructive actions and assess recovery or data-loss consequences promptly.
Example in practice
Hypothetical example: An old key appears unused in production but protects a retained backup. Dependency review catches the relationship and postpones destruction until an approved retention or migration decision is made.
Related controls
- CF05-016: AI Data Secure Disposal
- CF05-S13: AI Encryption Key Archival
- CF05-S16: AI Encryption Key Inventory Management
Framework mappings
- CSA AICM (CEK-14)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0