Device Lifecycle and Sanitization

Control Statement

Devices shall be provisioned from a trusted baseline and, on retirement, loss or reassignment, shall be removed from the estate's trust and their media sanitized within a stated period.

Purpose. To close the ends of the device lifecycle — the point of entry and the point of exit — where trust is granted and where it is most often left behind.

Discussion

The exit end is where this control earns its place. A retired, lost or reassigned device frequently retains enrollment, certificates, cached credentials and stored data long after it has left the population it was issued to — which makes it an unattributed device holding valid trust, exactly the condition DV-1 is designed to surface and WF-5 assumes has been handled. The stated period matters as much as the action: a sanitization process that completes eventually is not a control against a device already outside the agency's physical control.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Provision devices from a defined baseline image or configuration.
2. L2Remove retired, lost and reassigned devices from the estate's trust.
3. L2Sanitize media on retirement or reassignment.
4. L3Verify the provisioning baseline's integrity and provenance under LC-2, so a trusted baseline is trusted for a reason.
5. L3State the period within which trust must be removed following retirement, loss or reassignment, derived from what the device's retained trust could do, with provenance per GA4.
6. L3Reconcile device retirement against the identity plane and WF-5 revocation, so a device leaving with a person is handled once rather than twice.
7. L3Record sanitization with its method and verification, and record devices that left the estate unsanitised as findings rather than as losses.
8. L4Measure elapsed time from retirement, loss or reassignment to trust removal, against the stated period.
9. L4Trend the population of devices holding trust with no current holder, which is the direct measure of this control's exit end.
10. L5Reduce what a device retains — moving to brokered access, ephemeral credentials and non-persistent workspaces — so retirement removes less.

Measurement

Evidence and Assessment

Related Guidance

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.