2.5 Ensure appropriate asset retention

2.6 Determine data security controls & compliance requirements

• 2.6.1 Data States
• 2.6.2 Scoping and Tailoring (NIST SP 800-53B)
• 2.6.3 Standards Selection
• 2.6.4 Data Protection methods