new From an ISO perspective, no documentation (e.g., policy, procedure) is required. However, it is important to have a disposal and destruction policy, acceptable usage policy, and security operations procedures in place that specify how system administrators and other responsible personnel must delete sensitive information from their devices, servers, and networks. It is also important to have a data retention policy that defines how long each category of information should be stored and when it should be erased., in future