Which outcome ensures that a disposal strategy is developed and implemented when a system is decommissioned?

• A. A system disposal strategy is developed and implemented, as needed.
• B. Risk management documents are updated based on continuous monitoring activities.
• C. A process to report the security and privacy posture to the authorizing official and other senior leaders and executives.
• D. The output of continuous monitoring activities is analyzed and responded to appropriately.

Answer: (A)

Having a formal system disposal strategy that is developed and implemented ensures that decommissioning is planned and executed in a controlled way. This establishes the defined steps, responsibilities, and timelines for securely disposing of assets and sanitizing data, aligning with applicable laws and policies. Without this plan, decommissioning can become ad hoc, risking data remnants, non-compliance, and improper disposal.

The other activities—updating risk documents from continuous monitoring, reporting security posture to leadership, and analyzing monitoring outputs to respond—are important for ongoing operations and oversight, but they do not guarantee that a disposal strategy exists or is carried out during decommissioning.