ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Prior to shutting down or removing a system, the RMF decommissioning step requires a deliberate review with those who understand the organization's legal, regulatory, and business obligations. Facilitating a formal meeting with the system owner, legal/compliance counsel, records management, and privacy officers enables identification of statutory data-retention periods, e-discovery holds, contractual duties, and ongoing mission needs. Documenting the agreed-upon sanitization, archiving, and reporting activities demonstrates that the organization has validated requirements and secured management approval before executing technical disposal tasks. Simply erasing media, powering systems off, or notifying users may be necessary later, but none of those tasks by themselves confirms that all obligations have been analyzed and accepted by the appropriate authorities.