You have a hard copy of a customer design document that you want to dispose off. What would you do

A customer design document is considered sensitive and confidential information. According to the information security principles outlined in the ISO/IEC 27001 standard, media containing such information must be disposed of securely to prevent unauthorized access and disclosure. Shredding is a standard and effective method for the secure destruction of paper-based documents, rendering the information unreadable and irrecoverable. This practice directly supports the control objective of preventing the leakage of sensitive information from media that is no longer required, thereby protecting customer confidentiality and mitigating the risk of a data breach.

A. Throwing it in any dustbin allows for unauthorized retrieval (e.g., dumpster diving), which is a significant security risk and a breach of confidentiality.

C. Giving it to an office boy for reuse constitutes an unauthorized disclosure of confidential customer information to an individual without a need-to-know.

D. Reusing the paper for writing does not destroy the original sensitive data, leaving it exposed and vulnerable to accidental or intentional compromise.

1. ISO/IEC 27001:2013, Annex A, Control A.8.3.2 (Disposal of media): This control explicitly states, "Media shall be disposed of securely when no longer required." The implementation of this control requires organizations to use formal procedures for secure disposal.

2. ISO/IEC 27002:2013, Section 8.3.2 (Disposal of media - Implementation guidance): This standard provides guidance for implementing control A.8.3.2. It specifies that "paper documents should be shredded" and advises using shredders that reduce documents to a size that is difficult to reconstruct, ensuring the destruction of sensitive information.

3. University of Cambridge, Information Services, "Securely deleting data & disposing of equipment": In its guidance on handling confidential information, the university's policy, which aligns with ISO 27001 principles, states: "Paper documents containing confidential information should be shredded (preferably cross-cut) before disposal." This exemplifies the practical application of the standard in a reputable institutional setting.