ISC2 CISSP Practice Question

The correct answer is to conduct a data classification review, then apply appropriate sanitization methods based on data sensitivity. This approach follows security best practices for system retirement by first understanding what types of data exist on the systems (through classification), and then applying the appropriate data destruction techniques based on that classification. Different types of data require different levels of sanitization - some may require complete physical destruction while others might only need secure wiping. This methodical approach ensures compliance with regulations while protecting sensitive information.

The other options are incorrect because:

• Simply transferring data to new systems before physical destruction doesn't address proper data sanitization and may leave sensitive information vulnerable during transfer.
• Performing backups without classification doesn't address how to properly destroy the data according to its sensitivity level.
• Outsourcing to a vendor without specific security requirements puts the organization at risk of improper disposal practices that could lead to data breaches.